Unscored severity · published Jun 2, 2015
CVE-2015-3982
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DJ
Django · Djangoproject
1.8.0; 1.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3982
www.securityfocus.com
http://www.securityfocus.com/bid/74960
Patch
https://www.djangoproject.com/weblog/2015/may/20/security-release/
More from Django
9.8
CVE-2026-4277
Privilege abuse in GenericInlineModelAdmin
9.8
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7
9.8
CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17
9.8
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files
9.8
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6