IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
2.3Niedrig

CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

djangoproject Django Veröffentlicht: (vor 6 Monaten)

Beschreibung

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

Schwachstellentyp (CWE): CWE-539

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
djangoproject Django 6.0 – < 6.0.5, fixed 6.0.5, 5.2 – < 5.2.14, fixed 5.2.14

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 5.2 < 5.2.14
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 6.0 < 6.0.5

Neue CVEs im selben Produkt — Django

5.3Mittel
CVE-2026-114582

Server-side request forgery via SpatialReference string input

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing s…

5.3Mittel
CVE-2026-111211

Potential log injection via unescaped geometry form values

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values befor…