contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-django | Jul 30, 2024 | Aug 24, 2015 |
| Freebsd | — | Upgrade py33-django17Upgrade py33-django14Upgrade py27-django14Upgrade py34-djangoUpgrade py27-django-develUpgrade py34-django14Upgrade py33-djangoUpgrade py27-djangoUpgrade py34-django-develUpgrade py32-django14Upgrade py34-django17Upgrade py32-djangoUpgrade py32-django-develUpgrade py32-django17Upgrade py27-django17Upgrade py33-django-devel | Dec 10, 2025 | Aug 18, 2015 |
| Oracle Solaris | — | Upgrade library/python/django to version 1.4.22-0.175.3.1.0.2.0 on Solaris 11.3Upgrade library/python/django-26 to version 1.4.22-0.175.3.1.0.2.0 on Solaris 11.3Upgrade library/python/django-27 to version 1.4.22-0.175.3.1.0.2.0 on Solaris 11.3 | May 29, 2017 | Aug 24, 2015 |
| Suse | — | Upgrade python-django | Dec 18, 2015 | Aug 24, 2015 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Nov 8, 2024 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub