#VU44589 Input validation error in Django - CVE-2011-4136
Published: October 19, 2011 / Updated: August 11, 2020
Vulnerability identifier: #VU44589
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2011-4136
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Django
Django
Software vendor:
Django Software Foundation
Django Software Foundation
Description
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Remediation
Install update from vendor's website.
External links
- http://openwall.com/lists/oss-security/2011/09/11/1
- http://openwall.com/lists/oss-security/2011/09/13/2
- http://secunia.com/advisories/46614
- http://www.debian.org/security/2011/dsa-2332
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- https://hermes.opensuse.org/messages/14700881
- https://www.djangoproject.com/weblog/2011/sep/09/
- https://www.djangoproject.com/weblog/2011/sep/10/127/