CVE-2007-0405
Django 0.95 - Authenticated Privilege Escalation via LazyUser Caching
Title source: llmDescription
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31628
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/23826
Various Sources x_refsource_confirm
http://code.djangoproject.com/changeset/3754
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/22138
Scores
EPSS
0.0119
EPSS Percentile
64.6%
Details
Status
published
Products (2)
django_project/django
0.95
pypi/Django
0.95 - 1.0PyPI
Published
Jan 23, 2007
Tracked Since
Feb 18, 2026