{"action":"Upgrade django to 1.8.2 or later.","affected":[{"fixed":"1.8.2","introduced":"1.8a1"}],"component":"django","cve_ids":["CVE-2015-3982"],"ecosystem":"PyPI","epss":0.0175,"exploited":false,"fixed_versions":["1.8.2"],"ghsa_id":"GHSA-6wgp-fwfm-mxp3","id":"tcs_01M5KF4D1XQV7HTE4QA4VCGB3H","modified_at":"2024-09-17T15:22:38.801640Z","published_at":"2022-05-17T03:29:56Z","references":["https://osv.dev/vulnerability/GHSA-6wgp-fwfm-mxp3","https://nvd.nist.gov/vuln/detail/CVE-2015-3982","https://github.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-19.yaml","https://web.archive.org/web/20200228092138/http://www.securityfocus.com/bid/74960","https://www.djangoproject.com/weblog/2015/may/20/security-release"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-6wgp-fwfm-mxp3","url":"https://osv.dev/vulnerability/GHSA-6wgp-fwfm-mxp3"}],"summary":"Django allows user sessions hijacking via an empty string in the session key"}