Django Software Foundation · Django · CVE-2014-0482
**Name of the Vulnerable Software and Affected Versions**
Django versions 1.4.x through 1.4.13
Django versions 1.5.x through 1.5.8
Django versions 1.6.x through 1.6.5
Django versions 1.7 before release candidate 3
**Description**
The issue allows remote authenticated users to hijack web sessions via vectors related to the `REMOTE USER` header when using the `contrib.auth.backends.RemoteUserBackend` backend with the `contrib.auth.middleware.RemoteUserMiddleware` middleware.
**Recommendations**
For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later.
For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later.
For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later.
For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.