Django 'session.flush()' Function Session Fixation Vulnerability
BID:74960
Info
Django 'session.flush()' Function Session Fixation Vulnerability
| Bugtraq ID: | 74960 |
| Class: | Design Error |
| CVE: |
CVE-2015-3982 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 02 2015 12:00AM |
| Updated: | Jun 02 2015 12:00AM |
| Credit: | Sam Cooke |
| Vulnerable: |
Djangoproject Django 1.8.1 Djangoproject Django 1.8 |
| Not Vulnerable: |
Djangoproject Django 1.8.2 |
Discussion
Django 'session.flush()' Function Session Fixation Vulnerability
Django is prone to a session-fixation vulnerability.
An attacker can exploit this issue to hijack an arbitrary session or gain access to the sensitive information. This may aid in further attacks.
Django versions 1.8.0 and 1.8.1 are vulnerable.
Django is prone to a session-fixation vulnerability.
An attacker can exploit this issue to hijack an arbitrary session or gain access to the sensitive information. This may aid in further attacks.
Django versions 1.8.0 and 1.8.1 are vulnerable.
Solution / Fix
Django 'session.flush()' Function Session Fixation Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.