CVE-2011-4136: Djangoproject Django

Medium severity, CVSS 5.8. EPSS: 2.3% chance of exploitation in the next 30 days.

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

Affected products

• Djangoproject Django: up to and including 1.2.6; version 0.91 only; version 0.95 only; version 0.95.1 only; version 0.96 only; version 1.0 only; …

Published 2011-10-19. Last modified 2026-06-16.