Code injection

2015-08-2414:59:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.6%

JSON

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.

CPENameOperatorVersion
ubuntu_linuxeq12.04
ubuntu_linuxeq14.04
ubuntu_linuxeq15.04
djangoeq1.4.12
djangoeq1.7.5
djangoeq1.7.9
djangoeq1.7.3
djangoeq1.4.9
djangoeq1.8.2
djangoeq1.7 rc2

Name	Operator	Version
ubuntu_linux	eq	12.04
ubuntu_linux	eq	14.04
ubuntu_linux	eq	15.04
django	eq	1.4.12
django	eq	1.7.5
django	eq	1.7.9
django	eq	1.7.3
django	eq	1.4.9
django	eq	1.8.2
django	eq	1.7 rc2