CVE-2015-3982: Django Session Hijacking Vulnerability
Summary
CVE-2015-3982: The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. Affects django versions >= 1.8, < 1.8.2. Fixed in 1.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes a session management feature that allows developers to store user-specific data across multiple requests. The session data can be stored in various backends, including the cached_db backend. However, a vulnerability exists in Django versions 1.8.x before 1.8.2 that affects the session.flush function in the cached_db backend. This vulnerability can be exploited by remote attackers to hijack user sessions by using an empty string as the session key.
Vulnerability Detail
The session.flush function in the cached_db backend of Django 1.8.x before 1.8.2 does not properly flush the session, allowing remote attackers to hijack user sessions. By sending a specially crafted request with an empty string as the session key, an attacker can bypass the session management mechanism and gain unauthorized access to a user's session. This can lead to various security risks, such as unauthorized access to sensitive user data or performing actions on behalf of the user.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.2
This is the first release that contains the fix.
pip install --upgrade "django==1.8.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by modifying the session management code. Developers can manually flush the session after each request to ensure that the session data is properly cleared. Here is an example of how to implement this workaround in Django:
from django.contrib.sessions.backends.cached_db import SessionStore
def flush_session(request):
session_key = request.session.session_key
if session_key:
session = SessionStore(session_key=session_key)
session.flush()
Conclusion
The Django Session Hijacking Vulnerability (CVE-2015-3982) affects Django versions 1.8.x before 1.8.2. It allows remote attackers to hijack user sessions by exploiting a flaw in the session.flush function of the cached_db backend. To mitigate this vulnerability, it is recommended to upgrade Django to version 1.8.2 or later. If immediate upgrade is not feasible, developers can implement a temporary workaround by manually flushing the session after each request. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows remote attackers to hijack user sessions in Django web applications. By exploiting this vulnerability, an attacker can gain unauthorized access to a user's session, potentially leading to unauthorized access to sensitive user data or performing actions on behalf of the user.
Django versions 1.8.x before 1.8.2 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Django application is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including this specific vulnerability.
Yes, the Django development team has released a fix for this vulnerability in Django version 1.8.2. It is recommended to upgrade to this version or later to mitigate the risk of session hijacking.
Yes, a temporary workaround can be implemented by manually flushing the session after each request. This ensures that the session data is properly cleared and reduces the risk of session hijacking. Refer to the 'workaround' section for an example of how to implement this workaround in Django.
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
