6.5med
CVE-2007-0405
Django Improper Access Control
Also known as GHSA-mwv2-398h-v489, PYSEC-2026-629
Published 19 y ago · modified 4 mo ago · JSON
CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
Exploit prediction (EPSS)
1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=0.95, <1.0 | 1.0 |
Classification
- Technology feeds
- Django (RSS, critical only)
References
- exchange.xforce.ibmcloud.com /vulnerabilities/31628 · vdb-entry, x_refsource_XF, x_transferred
- secunia.com /advisories/23826 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- code.djangoproject.com /changeset/3754 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/22138 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2007-0405 · advisory
- github.com /django/django/commit/3c5782287e · web
- github.com /django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67 · web
- github.com /django/django · package
- pypi.org /project/django · package
- github.com /advisories/GHSA-mwv2-398h-v489 · advisory
Sources
- CVE List: CVE-2007-0405
- GitHub Advisory: GHSA-mwv2-398h-v489
- NVD: CVE-2007-0405
- OSV: PYSEC-2026-629
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.