#VU44589 Input validation error in Django - CVE-2011-4136

Vulnerability identifier: #VU44589

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-4136

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Django
Web applications / CMS

Vendor: Django Software Foundation

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Django: 0.91 - 0.96, 1.0 - 1.3

---

External links
https://openwall.com/lists/oss-security/2011/09/11/1
https://openwall.com/lists/oss-security/2011/09/13/2
https://secunia.com/advisories/46614
https://www.debian.org/security/2011/dsa-2332
https://bugzilla.redhat.com/show_bug.cgi?id=737366
https://hermes.opensuse.org/messages/14700881
https://www.djangoproject.com/weblog/2011/sep/09/
https://www.djangoproject.com/weblog/2011/sep/10/127/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.