CVE-2015-3982: High severity django vulnerability
Published Jun 2, 2015
·Updated
The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Affected Software
3 affected componentsFixes available
pip/Django>=1.8a1<1.8.2
1.8.2
djangoproject Django=1.8.0
djangoproject Django=1.8.1
Remediation
Event History
Jun 2, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·03:29 AM
Frequently Asked Questions
1
What is the severity of CVE-2015-3982?
CVE-2015-3982 is categorized as a medium severity vulnerability allowing session hijacking.
2
How do I fix CVE-2015-3982?
To fix CVE-2015-3982, upgrade Django to version 1.8.2 or later.
3
Which versions of Django are affected by CVE-2015-3982?
Django versions 1.8.0 and 1.8.1 are affected by CVE-2015-3982.
4
What impact does CVE-2015-3982 have on user sessions?
CVE-2015-3982 allows remote attackers to hijack user sessions through an empty string in the session key.
5
Is there a workaround for CVE-2015-3982 until I can update?
There is no official workaround for CVE-2015-3982; upgrading is the recommended solution.