CSRF in Djangoproject Django

CVE-2008-3909

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.009 (57.0th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References

  • cve@mitre.org (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Patch)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
  • cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Broken Link)
  • cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
  • cve@mitre.org (vdb-entry, Not Applicable, x_refsource_VUPEN)
  • cve@mitre.org (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
  • cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Broken Link)
  • cve@mitre.org (x_refsource_OSVDB, vdb-entry, Broken Link)