-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the RemoteUserMiddleware's handling of session persistence when the REMOTE_USER header changes. The pre-patch implementation in process_request only checked backend type during initial authentication but didn't properly handle subsequent requests with different REMOTE_USER values. The GitHub commit diff shows the addition of _remove_invalid_user() calls and username mismatch checks, confirming the vulnerable flow was in the process_request method. The CVE description explicitly implicates RemoteUserMiddleware+RemoteUserBackend combinations, and the patch modifies this specific function to add session invalidation logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django | pip | < 1.4.14 | 1.4.14 |
| Django | pip | >= 1.5, < 1.5.9 | 1.5.9 |
| Django | pip | >= 1.6, < 1.6.6 | 1.6.6 |
| Django | pip | >= 1.7a1, < 1.7c3 | 1.7c3 |