Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-84qe-mdwm-y3ey

Summary

Django Improper Access Control
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.

Aliases

alias	CVE-2007-0405

alias	GHSA-mwv2-398h-v489

Fixed_packages

url pkg:pypi/django@1.0

purl pkg:pypi/django@1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18gm-v5zp-tqf9

vulnerability	VCID-u4sa-1yn4-h3ff

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@1.0

Affected_packages

url pkg:pypi/django@0.95

purl pkg:pypi/django@0.95

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4z7r-xd8z-3ybm

vulnerability	VCID-84qe-mdwm-y3ey

vulnerability	VCID-kc75-qwxj-hbec

vulnerability	VCID-ukf6-xwqc-xkdc

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@0.95

References

reference_url	https://exchange.xforce.ibmcloud.com/vulnerabilities/31628
reference_id
reference_type
scores
url	https://exchange.xforce.ibmcloud.com/vulnerabilities/31628

reference_url	https://github.com/django/django
reference_id
reference_type
scores
url	https://github.com/django/django

reference_url	https://github.com/django/django/commit/3c5782287e
reference_id
reference_type
scores
url	https://github.com/django/django/commit/3c5782287e

reference_url	https://github.com/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67
reference_id
reference_type
scores
url	https://github.com/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2007-0405
reference_id	CVE-2007-0405
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2007-0405

reference_url	https://github.com/advisories/GHSA-mwv2-398h-v489
reference_id	GHSA-mwv2-398h-v489
reference_type
scores
url	https://github.com/advisories/GHSA-mwv2-398h-v489

Weaknesses

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-84qe-mdwm-y3ey

Vulnerability Instance