CVE-2014-0482

Published: Aug 26, 2014Modified: May 6, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.

Affected (42)

Products: Opensuse: Opensuse · Djangoproject: Django

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.6.1
Djangoproject Django	Version 1.6.2
Djangoproject Django	Version 1.6.3
Djangoproject Django	Version 1.6.4
Djangoproject Django	Version 1.6.5
Djangoproject Django	Version 1.6
Djangoproject Django	Version 1.6 beta1
Djangoproject Django	Version 1.6 beta2
Djangoproject Django	Version 1.6 beta3
Djangoproject Django	Version 1.6 beta4

Configuration C

13 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Up to 1.4.13
Djangoproject Django	Version 1.4.10
Djangoproject Django	Version 1.4.11
Djangoproject Django	Version 1.4.12
Djangoproject Django	Version 1.4.1
Djangoproject Django	Version 1.4.2
Djangoproject Django	Version 1.4.4
Djangoproject Django	Version 1.4.5
Djangoproject Django	Version 1.4.6
Djangoproject Django	Version 1.4.7
Djangoproject Django	Version 1.4.8
Djangoproject Django	Version 1.4.9
Djangoproject Django	Version 1.4

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.7 beta1
Djangoproject Django	Version 1.7 beta2
Djangoproject Django	Version 1.7 beta3
Djangoproject Django	Version 1.7 beta4
Djangoproject Django	Version 1.7 rc1
Djangoproject Django	Version 1.7 rc2

Configuration E

11 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.5.1
Djangoproject Django	Version 1.5.2
Djangoproject Django	Version 1.5.3
Djangoproject Django	Version 1.5.4
Djangoproject Django	Version 1.5.5
Djangoproject Django	Version 1.5.6
Djangoproject Django	Version 1.5.7
Djangoproject Django	Version 1.5.8
Djangoproject Django	Version 1.5
Djangoproject Django	Version 1.5 alpha
Djangoproject Django	Version 1.5 beta