Improper Authentication in Django and Opensuse - CVE-2014-0482
Published: August 26, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41379
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0482
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to read and manipulate data.
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
Affected software
Django
Opensuse
Gentoo Linux
Fedora
Ubuntu
python-django (Ubuntu package)
Django14
Opensuse
Gentoo Linux
Fedora
Ubuntu
python-django (Ubuntu package)
Django14
How to mitigate CVE-2014-0482
Install update from vendor's website.
python-django (Ubuntu package) - addressed in versions 1.1.1-2ubuntu1.13, 1.3.1-4ubuntu1.12, 1.6.1-2ubuntu0.4
Django14 - update to 1.4.14-1.el6
Django14 - update to 1.4.14-1.el6