CVE-2011-4136

Description

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

How to fix CVE-2011-4136

To remediate CVE-2011-4136, upgrade the affected package to a fixed version below.

• —upgrade to 1.3.1-1 or later
• —upgrade to 1.2.3-3+squeeze2 or later
• —upgrade to 1.2.7 or later
• —upgrade to 1.2.7 or later

Is CVE-2011-4136 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 1.3.1-1
• from 0, < 1.2.3-3+squeeze2
• from 0, < 1.2.7
• from 0, < 1.2.7, >= 1.3, < 1.3.1

CVSS scores

References (17)

• ADVISORYsecunia.com/advisories/46614
• ADVISORYgithub.com/advisories/GHSA-x88j-93vc-wpmp
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2011-4136
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2011-4136
• ADVISORY