CVE-2014-0482

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-26 · updated 2026-06-17
Weakness: CWE-287

Description

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.

Affected products

Django: through 1.4.13; 1.6, 1.6-beta1, 1.6-beta2, 1.6-beta3, 1.6-beta4, 1.6.1 (+33)
Opensuse: 12.3, 13.1

References

http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010
https://www.djangoproject.com/weblog/2014/aug/20/security/
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010
https://www.djangoproject.com/weblog/2014/aug/20/security/

Get alerted when CVE-2014-0482 or the next vulnerability affects your stack