| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 0.95, < 1.0 | 1.0 |
| django | = 0.95 |
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free