Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2014-05-16T15:00:00

Updated: 2024-08-06T09:42:35.452Z

Reserved: 2014-01-13T00:00:00

Link: CVE-2014-1418

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2014-05-16T15:55:04.597

Modified: 2024-11-21T02:04:14.533

Link: CVE-2014-1418

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-05-14T00:00:00Z

Links: CVE-2014-1418 - Bugzilla