CVE-2014-1418
No CVSS score yet. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in django 1.4.13, 1.5.8, 1.6.5.
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q7q2-qf2q-rw3w | PyPI | django | >=1.4 <1.4.13 | 1.4.13 |
| GHSA-q7q2-qf2q-rw3w | PyPI | django | >=1.5 <1.5.8 | 1.5.8 |
| GHSA-q7q2-qf2q-rw3w | PyPI | django | >=1.6 <1.6.5 | 1.6.5 |
| GHSA-q7q2-qf2q-rw3w | PyPI | django | >=1.7a1 <1.7b4 | 1.7b4 |
| PYSEC-2014-19 | PyPI | django | >=1.4 <1.4.13 >=1.5 <1.5.8 >=1.6 <1.6.5 >=1.7a0 <1.7b4 | 1.4.13, 1.5.8, 1.6.5, 1.7b4 |