Threats tagged 'ghsa-qpc8-7fxc-cm4p'

A vulnerability in Django's UpdateCacheMiddleware allows private cached responses to be read by unauthenticated remote attackers. This occurs because the middleware does not add the Authorization header to the Vary response header for requests that include Authorization without Cache-Control: public. The issue affects Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6. Earlier unsupported versions may also be affected. The vulnerability has a low severity score and no known exploits in the wild.