CVE-2014-0482
No CVSS score yet. EPSS 2.0% chance of exploitation in the next 30 days. Fixed in django 1.4.14, 1.5.9, 1.6.6.
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
- opensuse:opensuse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-625g-gx8c-xcmg | PyPI | django | <1.4.14 | 1.4.14 |
| GHSA-625g-gx8c-xcmg | PyPI | django | >=1.5 <1.5.9 | 1.5.9 |
| GHSA-625g-gx8c-xcmg | PyPI | django | >=1.6 <1.6.6 | 1.6.6 |
| GHSA-625g-gx8c-xcmg | PyPI | django | >=1.7a1 <1.7c3 | 1.7c3 |
| PYSEC-2014-6 | PyPI | django | <1.4.14 >=1.5 <1.5.9 >=1.6 <1.6.6 | 1.4.14, 1.5.9, 1.6.6 |