NVD

Id
30074  
Name
CVE-2014-1418  
Description
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-05-16  
Modified Date
2017-01-06  
Seq
2014-1418  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
158301 30074 CVE-2014-1418 openSUSE-SU-2014:1132  View
158302 30074 CVE-2014-1418 61281  View
158303 30074 CVE-2014-1418 USN-2212-1  View
158304 30074 CVE-2014-1418 DSA-2934  View
158305 30074 CVE-2014-1418 [oss-security] 20140514 CVE Reuest: Django: Malformed URLs from user input incorrectly validated  View
158306 30074 CVE-2014-1418 [oss-security] 20140514 Re: CVE Reuest: Django: Malformed URLs from user input incorrectly validated  View
158307 30074 CVE-2014-1418 https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13652 JVNDB-2014-002527 Django における重要な情報を取得される脆弱性 Django は、レスポンス内に (1) Vary: Cookie または (2) Cache-Control ヘッダを適切に含めないため、重要な情報を取得される、またはキャッシュを改ざん (ポイズニング) される脆弱性が存在します。 CVE-2014-1418 68705 CVE-2014-1418 30074 6.4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002527.html 2014-05-14 2014-05-19 View