CVE-2014-0482: Medium severity opensuse vulnerability

Q: What is the severity of CVE-2014-0482?

CVE-2014-0482 has a medium severity rating as it allows remote authenticated users to hijack web sessions.

Q: How do I fix CVE-2014-0482?

To fix CVE-2014-0482, upgrade to Django version 1.4.14, 1.5.9, 1.6.6, or 1.7 release candidate 3.

Q: Which Django versions are affected by CVE-2014-0482?

Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 are affected.

Q: What is the cause of the vulnerability in CVE-2014-0482?

The vulnerability in CVE-2014-0482 is caused by the `RemoteUserMiddleware` not properly validating remote authenticated users.

Q: Can CVE-2014-0482 affect web application security?

Yes, CVE-2014-0482 can significantly impact web application security by allowing unauthorized session access.

Published Aug 26, 2014

Updated

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTEUSER header.

Other sources

Affected Software

46 affected componentsFixes available

pip/Django>=1.7a1<1.7c3

1.7c3

pip/Django>=1.6<1.6.6

1.6.6

pip/Django>=1.5<1.5.9

1.5.9

pip/django<1.4.14

1.4.14

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

djangoproject Django=1.6

djangoproject Django=1.6-beta1

djangoproject Django=1.6-beta2

djangoproject Django=1.6-beta3

djangoproject Django=1.6-beta4

djangoproject Django=1.6.1

djangoproject Django=1.6.2

djangoproject Django=1.6.3

djangoproject Django=1.6.4

djangoproject Django=1.6.5

djangoproject Django<=1.4.13

djangoproject Django=1.4

djangoproject Django=1.4.1

djangoproject Django=1.4.2

djangoproject Django=1.4.4

djangoproject Django=1.4.5

djangoproject Django=1.4.6

djangoproject Django=1.4.7

djangoproject Django=1.4.8

djangoproject Django=1.4.9

djangoproject Django=1.4.10

djangoproject Django=1.4.11

djangoproject Django=1.4.12

djangoproject Django=1.7-beta1

djangoproject Django=1.7-beta2

djangoproject Django=1.7-beta3

djangoproject Django=1.7-beta4

djangoproject Django=1.7-rc1

djangoproject Django=1.7-rc2

djangoproject Django=1.5

djangoproject Django=1.5-alpha

djangoproject Django=1.5-beta

djangoproject Django=1.5.1

djangoproject Django=1.5.2

djangoproject Django=1.5.3

djangoproject Django=1.5.4

djangoproject Django=1.5.5

djangoproject Django=1.5.6

djangoproject Django=1.5.7

djangoproject Django=1.5.8

Event History

Aug 26, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

May 14, 2022

Advisory Published

02:09 AM

Frequently Asked Questions

What is the severity of CVE-2014-0482?

CVE-2014-0482 has a medium severity rating as it allows remote authenticated users to hijack web sessions.

How do I fix CVE-2014-0482?