Django Session Fixation Vulnerability via Cached Public Pages

A session fixation vulnerability has been identified in Django versions 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14. The issue arises when the `SESSION_SAVE_EVERY_REQUEST` setting is enabled, as response headers do not change on cookies if a session remains unaltered. This allows remote attackers to steal user sessions after they have visited a cached public page. Additionally, earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

Impact

Exploitation of this vulnerability allows for session fixation, where an attacker can hijack a user's session.

Remediation

Users can upgrade to Django 6.0.5 or 5.2.14 to address this vulnerability.