CVE-2008-3909 Django cross-site request forgery (CSRF) vulnerability
MediumCVSS 5.8
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 0.91.0, < 0.91.3 | 0.91.3 |
| pypi django(PyPI) | >= 0.95.0, < 0.95.4 | 0.95.4 |
| pypi django(PyPI) | >= 0.96.0, < 0.96.3 | 0.96.3 |
| pypi django(PyPI) | < 1.1 | 1.1 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| djangoproject django | >= 0.91, < 0.91.3 | 0.91.3 |
| djangoproject django | >= 0.95, < 0.95.4 | 0.95.4 |
| djangoproject django | >= 0.96, < 0.96.3 | 0.96.3 |
| debian/python-django(Debian:12) | < 1.0-1 | 1.0-1 |
| debian/python-django(Debian:13) | < 1.0-1 | 1.0-1 |
| debian/python-django(Debian:14) | < 1.0-1 | 1.0-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- github.com
- FEDORA-2008-7288 broken-link vendor-advisory
- FEDORA-2008-7672 broken-link vendor-advisory
- DSA-1640 third-party-advisory vendor-advisory
- www.djangoproject.com patch technical-description
- [oss-security] 20080903 django CSRF vuln mailing-list third-party-advisory
- 31837 not-applicable third-party-advisory vendor-advisory
- 31961 not-applicable third-party-advisory vendor-advisory
- 47906 broken-link vdb-entry
- ADV-2008-2533 not-applicable vdb-entry vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2008-3909 vendor-advisory