CVE-2011-4138 Django Might Allow CSRF Requests via URL Verification
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.2.7 | 1.2.7 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | >= 1.3, < 1.3.1 | 1.3.1 |
| pypi django(PyPI) | = 1.3 | No fix listed |
| debian/python-django(Debian:12) | < 1.3.1-1 | 1.3.1-1 |
| debian/python-django(Debian:13) | < 1.3.1-1 | 1.3.1-1 |
| debian/python-django(Debian:14) | < 1.3.1-1 | 1.3.1-1 |
| djangoproject django | <= 1.2.6 | No fix listed |
| djangoproject django | = 0.91 | No fix listed |
| djangoproject django | = 0.95 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| djangoproject django | = 0.95.1 | No fix listed |
| djangoproject django | = 0.96 | No fix listed |
| djangoproject django | = 1.0 | No fix listed |
| djangoproject django | = 1.0.1 | No fix listed |
| djangoproject django | = 1.0.2 | No fix listed |
| djangoproject django | = 1.1 | No fix listed |
| djangoproject django | = 1.1.0 | No fix listed |
| djangoproject django | = 1.1.2 | No fix listed |
| djangoproject django | = 1.1.3 | No fix listed |
| djangoproject django | = 1.2 | No fix listed |
| djangoproject django | = 1.2.1 | No fix listed |
| djangoproject django | = 1.2.1-2 | No fix listed |
| djangoproject django | = 1.2.2 | No fix listed |
| djangoproject django | = 1.2.3 | No fix listed |
| djangoproject django | = 1.2.4 | No fix listed |
| djangoproject django | = 1.2.5 | No fix listed |
| djangoproject django | = 1.3 | No fix listed |
| djangoproject django | = 1.3-alpha1 | No fix listed |
| djangoproject django | = 1.3-alpha2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking patch
- github.com product
- github.com
- openSUSE-SU-2012:0653 vendor-advisory
- www.djangoproject.com patch technical-description vendor-advisory
- www.djangoproject.com patch technical-description
- [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- DSA-2332 vendor-advisory
- 46614 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2011-4138 vendor-advisory
- bugs.debian.org issue-tracking