CVE-2011-4136
Session manipulation in Django
CVE-2011-4136 is a medium vulnerability (CVSS 5.8) in Djangoproject Django, published October 19, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in django 1.2.7.
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Exploit likelihood
What each source reports
NVD Score used
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
CVE-2011-4136- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
CVE-2011-4136- Updated
- 2026-11-02
EUVDEUVD-2011-0003 No score
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
EUVD-2011-0003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x88j-93vc-wpmp
Session manipulation in Django
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
GHSA-x88j-93vc-wpmp- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-x88j-93vc-wpmp
Session manipulation in Django
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
GHSA-x88j-93vc-wpmp- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
CVE-2011-4136- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4136 No score
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
DEBIAN-CVE-2011-4136- Updated
- 2026-11-02
OSVPYSEC-2011-1 No score
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
- Record
PYSEC-2011-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
before 1.2.7 | 1.2.7 |
djangoPyPI |
1.3 up to 1.3.1 | 1.3.1 |
python-djangoDebian:12 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:13 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:14 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze2, plus listed versions 1.2.3-31.2.3-3+squeeze1 |
1.2.3-3+squeeze2 |
python-djangoDebian:5.0 |
before 1.0.2-1+lenny3, plus listed versions 1.0.2-11.0.2-1+lenny11.0.2-1+lenny2 |
1.0.2-1+lenny3 |
djangoPyPI |
before 1.2.7, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 11 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.6 |
1.2.7 |
djangoPyPI |
before 1.2.7, 1.3 up to 1.3.1, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 11 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.6 |
1.2.71.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
hermes.opensuse.org/messages/14700881
debian.org/security/2011/dsa-2332
bugzilla.redhat.com/show_bug.cgi?id=737366
secunia.com/advisories/46614
openwall.com/lists/oss-security/2011/09/11/1
djangoproject.com/weblog/2011/sep/10/127
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2011-4136
github.com/advisories/GHSA-x88j-93vc-wpmp
security-tracker.debian.org/tracker/CVE-2011-4136