-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 1.8, < 1.8.4 | 1.8.4 |
| Django | pip | >= 1.7, < 1.7.10 | 1.7.10 |
| Django | pip | >= 1.4, < 1.4.22 | 1.4.22 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from three key points: 1) SessionBase.flush() and cached_db.SessionStore.flush() methods created new empty sessions after flushing, as shown in commit diffs replacing 'self.create()' with '_session_key = None'. 2) SessionMiddleware's process_response saved sessions even when empty, as patched by adding 'and not empty' condition. 3) Documentation updates explicitly reference these methods as being modified to prevent empty session creation. The combination of these functions' behavior allowed attackers to create unlimited empty sessions via logout requests.
Ongoing coverage of React2Shell