GitHub Advisoryadvisory · PyPI

GHSA-r5cj-wv24-92p5 Django cross-site request forgery (CSRF) vulnerability

HIGH Published 2022-05-02 Modified 2024-09-16 Official page ↗
Aliases
CVE-2008-3909
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2023-09-22

Affected packages

• PyPI Django: >= 0.91.0, < 0.91.3 → fixed in 0.91.3 • PyPI Django: >= 0.95.0, < 0.95.4 → fixed in 0.95.4 • PyPI Django: >= 0.96.0, < 0.96.3 → fixed in 0.96.3

Description

The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Related

Alias · CVE (1)

  • CVE-2008-3909 The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References