CVE-2015-3982
djangoproject django: no CVSS score yet. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in django 1.8.2.
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6wgp-fwfm-mxp3 | PyPI | django | >=1.8a1 <1.8.2 | 1.8.2 |
| PYSEC-2015-19 | PyPI | django | >=1.8 <1.8.2 | 1.8.2 |