CVE-2007-0405

Description

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.

How to fix CVE-2007-0405

To remediate CVE-2007-0405, upgrade the affected package to a fixed version below.

• PyPI/django—upgrade to 1.0 or later
• PyPI/django—upgrade to 1.0 or later

Is CVE-2007-0405 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 0.95, < 1.0
• >= 0.95, < 1.0

References (8)

• ADVISORYgithub.com/advisories/GHSA-mwv2-398h-v489
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-0405
• PATCHgithub.com/django/django
• PATCHpypi.org/project/django
• WEBcode.djangoproject.com/changeset/3754