CVE-2014-0482 json
Django Middleware Enables Session Hijacking
published 2014-08-26 12 y ago modified 2026-06-17 4 mo ago also GHSA-625g-gx8c-xcmg , PYSEC-2014-6 , EUVD-2014-0014
- cvss
- 6.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
Patch / fix
- pypi django 1.4.14, 1.5.9, 1.6.6, 1.7c3
- python-django Debian 14, Debian 13, Debian 12 1.6.6-1
debian advisories DEBIAN-CVE-2014-0482
- python-django Ubuntu 14.04 LTS 1.6.1-2ubuntu0.4
ubuntu advisories UBUNTU-CVE-2014-0482
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2014-0482 updated cvss 5.8
Django: RemoteUserMiddleware session hijacking
-
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) python-django Red Hat OpenStack Platform 4 Django14 Red Hat Subscription Asset Manager Djangoaffected: no fix available
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.96% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | <1.4.14 >=1.5, <1.5.9 >=1.6, <1.6.6 >=1.7a1, <1.7c3 |
1.4.14 1.5.9 1.6.6 1.7c3 |
Classification
- Weakness
-
- CWE-287 Improper Authentication
- Technology feeds
References
-
github.com
/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09
web
-
github.com
/django/django/commit/5307ce565fbedb9cc27cbe7c757b41a00438d37c
web
-
github.com
/django/django/commit/c9e3b9949cd55f090591fbdc4a114fcb8368b6d9
web
-
github.com
/django/django/commit/dd68f319b365f6cb38c5a6c106faf4f6142d7d88
web
-
lists.opensuse.org
/opensuse-updates/2014-09/msg00023.html
vendor-advisory, web
-
debian.org
/security/2014/dsa-3010
vendor-advisory, web, advisory
-
djangoproject.com
/weblog/2014/aug/20/security/
vendor-advisory, article
-
secunia.com
/advisories/61276
third-party-advisory, advisory
-
secunia.com
/advisories/61281
third-party-advisory, advisory
-
secunia.com
/advisories/59782
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2014-0482
advisory
-
github.com
/django/django
package
-
github.com
/django/django/blob/aa3cb3f37265be37d892e2b391ff023e9caee2a4/docs/releases/1.5.9.txt#L42
web
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-6.yaml
web
-
djangoproject.com
/weblog/2014/aug/20/security
web
-
github.com
/advisories/GHSA-625g-gx8c-xcmg
advisory
Sources
- CVE List CVE-2014-0482
- GitHub Advisory GHSA-625g-gx8c-xcmg
- NVD CVE-2014-0482
- OSV PYSEC-2014-6
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.