Description

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.

Remediation

References

CVE-2014-0482

Related Vulnerabilities

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-5611)

WordPress Plugin Forminator-Contact Form, Payment Form & Custom Form Builder Arbitrary File Upload (1.28.1)

WordPress Plugin WP Statistics SQL Injection (12.0.7)

PrestaShop Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2013-6358)

MySQL CVE-2020-14846 Vulnerability (CVE-2020-14846)

Severity

Medium

Classification

CVE-2014-0482 CWE-287

Tags

Missing Update Known Vulnerabilities