← Back

CVE-2015-5963

nvd nist
Published: Aug 24, 2015Modified: May 6, 2026

JSON object

Loading...
5.0
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
Exploitability: 10.0 / Impact: 2.9
Source: NVD

Description

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

Affected (43)

Djangoproject
1 product
Django
Oracle
1 product
Solaris
Canonical
1 product
Ubuntu Linux
Configuration A
39 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
Version 1.4.10
Django
Version 1.4.11
Django
Version 1.4.12
Django
Version 1.4.13
Django
Version 1.4.14
Django
Version 1.4.17
Django
Version 1.4.19
Django
Version 1.4.1
Django
Version 1.4.20
Django
Version 1.4.21
Django
Version 1.4.2
Django
Version 1.4.4
Django
Version 1.4.5
Django
Version 1.4.6
Django
Version 1.4.7
Django
Version 1.4.8
Django
Version 1.4.9
Django
Version 1.4
Django
Version 1.7.1
Django
Version 1.7.2
Django
Version 1.7.3
Django
Version 1.7.4
Django
Version 1.7.5
Django
Version 1.7.6
Django
Version 1.7.7
Django
Version 1.7.8
Django
Version 1.7.9
Django
Version 1.7 beta1
Django
Version 1.7 beta2
Django
Version 1.7 beta3
Django
Version 1.7 beta4
Django
Version 1.7 rc1
Django
Version 1.7 rc2
Django
Version 1.7 rc3
Django
Version 1.8.0
Django
Version 1.8.1
Django
Version 1.8.2
Django
Version 1.8.3
Django
Version 1.8 beta1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Solaris
Version 11.3
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 12.04
Ubuntu Linux
Version 14.04
Ubuntu Linux
Version 15.04

Related CWEs

CWE-399
CWE-399

References (26)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.