Improper Authentication in Django and Opensuse - CVE-2014-0482

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41379

Improper Authentication in Django and Opensuse - CVE-2014-0482

Published: August 26, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41379
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0482
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote #AU# to read and manipulate data.

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.


Affected software

Django
Opensuse
Gentoo Linux
Fedora
Django14

How to mitigate CVE-2014-0482

Install update from vendor's website.

Django14 - update to 1.4.14-1.el6

External References

Related Security Bulletins