Upstream information
Description
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 5.8 |
Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | None |
Integrity Impact | Partial |
Availability Impact | Partial |
SUSE Security Advisories:
- openSUSE-SU-2012:0653-1
SUSE Timeline for this CVE
CVE page created: Tue Jul 9 19:19:15 2013CVE page last modified: Thu Dec 7 13:05:17 2023