CVE-2011-4140 Django Cross-Site Request Forgery vulnerability
MediumCVSS 6.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | <= 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | >= 1.3, <= 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | < 1.2.7 | 1.2.7 |
| pypi django(PyPI) | >= 1.3, < 1.3.1 | 1.3.1 |
| debian/python-django(Debian:12) | < 1.3.1-1 | 1.3.1-1 |
| debian/python-django(Debian:13) | < 1.3.1-1 | 1.3.1-1 |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python-django(Debian:14) | < 1.3.1-1 | 1.3.1-1 |
| djangoproject django | <= 1.2.6 | No fix listed |
| djangoproject django | = 0.91 | No fix listed |
| djangoproject django | = 0.95 | No fix listed |
| djangoproject django | = 0.95.1 | No fix listed |
| djangoproject django | = 0.96 | No fix listed |
| djangoproject django | = 1.0 | No fix listed |
| djangoproject django | = 1.0.1 | No fix listed |
| djangoproject django | = 1.0.2 | No fix listed |
| djangoproject django | = 1.1 | No fix listed |
| djangoproject django | = 1.1.0 | No fix listed |
| djangoproject django | = 1.1.2 | No fix listed |
| djangoproject django | = 1.1.3 | No fix listed |
| djangoproject django | = 1.2 | No fix listed |
| djangoproject django | = 1.2.1 | No fix listed |
| djangoproject django | = 1.2.1-2 | No fix listed |
| djangoproject django | = 1.2.2 | No fix listed |
| djangoproject django | = 1.2.3 | No fix listed |
| djangoproject django | = 1.2.4 | No fix listed |
| djangoproject django | = 1.2.5 | No fix listed |
| djangoproject django | = 1.3 | No fix listed |
| djangoproject django | = 1.3-alpha1 | No fix listed |
| djangoproject django | = 1.3-alpha2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch
- github.com vendor-advisory
- github.com product
- github.com
- openSUSE-SU-2012:0653 vendor-advisory
- web.archive.org
- www.djangoproject.com patch technical-description vendor-advisory
- www.djangoproject.com patch technical-description
- [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list patch
- DSA-2332 vendor-advisory
- 46614 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2011-4140 vendor-advisory
- bugs.debian.org issue-tracking