CVE-2011-4136: Session manipulation in Django
(updated )
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session’s identifier.
References
- bugzilla.redhat.com/show_bug.cgi?id=737366
- github.com/advisories/GHSA-x88j-93vc-wpmp
- github.com/django/django
- github.com/django/django/commit/ac7c3a110f906e4dfed3a17451bf7fd9fcb81296
- github.com/django/django/commit/fbe2eead2fa9d808658ca582241bcacb02618840
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-1.yaml
- hermes.opensuse.org/messages/14700881
- nvd.nist.gov/vuln/detail/CVE-2011-4136
- www.djangoproject.com/weblog/2011/sep/09
- www.djangoproject.com/weblog/2011/sep/10/127
Code Behaviors & Features
Detect and mitigate CVE-2011-4136 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →