GitHub Advisoryadvisory · PyPI

GHSA-h95j-h2rv-qrg4 Django Cross-Site Request Forgery vulnerability

HIGH Published 2018-07-23 Modified 2024-09-16 Official page ↗
Aliases
CVE-2011-4140
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• PyPI Django: <= 1.2.7 (no fix yet) • PyPI Django: >= 1.3, <= 1.3.1 (no fix yet)

Description

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

Related

Alias · CVE (1)

  • CVE-2011-4140 The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References