This vulnerability involves the django.middleware.cache.UpdateCacheMiddleware component erroneously caching HTTP responses when the Vary header includes an asterisk ('*'). This behavior can lead to sensitive or private information being cached and subsequently served to unauthorized clients. The issue affects Django versions 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14, with possible impact on earlier unsupported versions such as 5.0.x, 4.1.x, and 3.2.x. The vulnerability is classified under CWE-524, indicating use of cache containing sensitive information. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited confidentiality impact.

The vulnerability can cause private data to be cached and served improperly due to incorrect handling of the Vary header with an asterisk. This may lead to unintended disclosure of sensitive information to unauthorized users. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not confirmed from the provided data; no official fix or vendor advisory is referenced. Users should check the official Django project advisories and update to versions 6.0.5 or later and 5.2.14 or later once confirmed. Until then, consider disabling or carefully configuring cache middleware to avoid caching responses with a Vary header containing '*'.