CVE-2007-0405 json
Django Improper Access Control
published 19y ago modified 4mo ago also GHSA-mwv2-398h-v489 , PYSEC-2026-629 , EUVD-2022-4642
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
Patch / fix
- pypi django 1.0
- python-django Debian 14, Debian 13, Debian 12 0.95.1-1
debian advisories DEBIAN-CVE-2007-0405
- github.com/django/django@3c57822 commit
- github.com/django/django@e89f0a6 commit
- secunia.com/advisories/23826 advisory
Is CVE-2007-0405 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.31% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=0.95, <1.0 |
1.0 |
Classification
- Technology feeds
References
-
secunia.com
/advisories/23826
third-party-advisory, patch, vendor-advisory
-
github.com
/django/django/commit/3c5782287e
web
-
github.com
/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67
web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/31628
vdb-entry, web
-
code.djangoproject.com
/changeset/3754
web
-
securityfocus.com
/bid/22138
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2007-0405
advisory
-
github.com
/django/django
package
-
pypi.org
/project/django
package
-
github.com
/advisories/GHSA-mwv2-398h-v489
advisory
Sources
- CVE List CVE-2007-0405
- GitHub Advisory GHSA-mwv2-398h-v489
- NVD CVE-2007-0405
- OSV PYSEC-2026-629
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.