CVE-2016-7401 Django CSRF Protection Bypass
HighCVSS 7.5
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.8.15 | 1.8.15 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3.2 | No fix listed |
| pypi django(PyPI) | = 1.3.3 | No fix listed |
| pypi django(PyPI) | = 1.3.4 | No fix listed |
| pypi django(PyPI) | = 1.3.5 | No fix listed |
| pypi django(PyPI) | = 1.3.6 | No fix listed |
Show 109 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.3.7 | No fix listed |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.14 | No fix listed |
| pypi django(PyPI) | = 1.4.15 | No fix listed |
| pypi django(PyPI) | = 1.4.16 | No fix listed |
| pypi django(PyPI) | = 1.4.17 | No fix listed |
| pypi django(PyPI) | = 1.4.18 | No fix listed |
| pypi django(PyPI) | = 1.4.19 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.20 | No fix listed |
| pypi django(PyPI) | = 1.4.21 | No fix listed |
| pypi django(PyPI) | = 1.4.22 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| pypi django(PyPI) | = 1.5 | No fix listed |
| pypi django(PyPI) | = 1.5.1 | No fix listed |
| pypi django(PyPI) | = 1.5.10 | No fix listed |
| pypi django(PyPI) | = 1.5.11 | No fix listed |
| pypi django(PyPI) | = 1.5.12 | No fix listed |
| pypi django(PyPI) | = 1.5.2 | No fix listed |
| pypi django(PyPI) | = 1.5.3 | No fix listed |
| pypi django(PyPI) | = 1.5.4 | No fix listed |
| pypi django(PyPI) | = 1.5.5 | No fix listed |
| pypi django(PyPI) | = 1.5.6 | No fix listed |
| pypi django(PyPI) | = 1.5.7 | No fix listed |
| pypi django(PyPI) | = 1.5.8 | No fix listed |
| pypi django(PyPI) | = 1.5.9 | No fix listed |
| pypi django(PyPI) | = 1.6 | No fix listed |
| pypi django(PyPI) | = 1.6.1 | No fix listed |
| pypi django(PyPI) | = 1.6.10 | No fix listed |
| pypi django(PyPI) | = 1.6.11 | No fix listed |
| pypi django(PyPI) | = 1.6.2 | No fix listed |
| pypi django(PyPI) | = 1.6.3 | No fix listed |
| pypi django(PyPI) | = 1.6.4 | No fix listed |
| pypi django(PyPI) | = 1.6.5 | No fix listed |
| pypi django(PyPI) | = 1.6.6 | No fix listed |
| pypi django(PyPI) | = 1.6.7 | No fix listed |
| pypi django(PyPI) | = 1.6.8 | No fix listed |
| pypi django(PyPI) | = 1.6.9 | No fix listed |
| pypi django(PyPI) | = 1.7 | No fix listed |
| pypi django(PyPI) | = 1.7.1 | No fix listed |
| pypi django(PyPI) | = 1.7.10 | No fix listed |
| pypi django(PyPI) | = 1.7.11 | No fix listed |
| pypi django(PyPI) | = 1.7.2 | No fix listed |
| pypi django(PyPI) | = 1.7.3 | No fix listed |
| pypi django(PyPI) | = 1.7.4 | No fix listed |
| pypi django(PyPI) | = 1.7.5 | No fix listed |
| pypi django(PyPI) | = 1.7.6 | No fix listed |
| pypi django(PyPI) | = 1.7.7 | No fix listed |
| pypi django(PyPI) | = 1.7.8 | No fix listed |
| pypi django(PyPI) | = 1.7.9 | No fix listed |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.14 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| pypi django(PyPI) | = 1.8a1 | No fix listed |
| pypi django(PyPI) | = 1.8b1 | No fix listed |
| pypi django(PyPI) | = 1.8b2 | No fix listed |
| pypi django(PyPI) | = 1.8c1 | No fix listed |
| pypi django(PyPI) | >= 1.9, < 1.9.10 | 1.9.10 |
| pypi django(PyPI) | = 1.9 | No fix listed |
| pypi django(PyPI) | = 1.9.1 | No fix listed |
| pypi django(PyPI) | = 1.9.2 | No fix listed |
| pypi django(PyPI) | = 1.9.3 | No fix listed |
| pypi django(PyPI) | = 1.9.4 | No fix listed |
| pypi django(PyPI) | = 1.9.5 | No fix listed |
| pypi django(PyPI) | = 1.9.6 | No fix listed |
| pypi django(PyPI) | = 1.9.7 | No fix listed |
| pypi django(PyPI) | = 1.9.8 | No fix listed |
| pypi django(PyPI) | = 1.9.9 | No fix listed |
| debian/python-django(Debian:12) | < 1:1.10-1 | 1:1.10-1 |
| debian/python-django(Debian:13) | < 1:1.10-1 | 1:1.10-1 |
| debian/python-django(Debian:14) | < 1:1.10-1 | 1:1.10-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| djangoproject django | <= 1.8.14 | No fix listed |
| djangoproject django | = 1.9.0 | No fix listed |
| djangoproject django | = 1.9.1 | No fix listed |
| djangoproject django | = 1.9.2 | No fix listed |
| djangoproject django | = 1.9.3 | No fix listed |
| djangoproject django | = 1.9.4 | No fix listed |
| djangoproject django | = 1.9.5 | No fix listed |
| djangoproject django | = 1.9.6 | No fix listed |
| djangoproject django | = 1.9.7 | No fix listed |
| djangoproject django | = 1.9.8 | No fix listed |
| djangoproject django | = 1.9.9 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com
- web.archive.org
- web.archive.org
- www.djangoproject.com patch technical-description vendor-advisory
- RHSA-2016:2038 vendor-advisory
- RHSA-2016:2039 vendor-advisory
- RHSA-2016:2040 vendor-advisory
- RHSA-2016:2041 vendor-advisory
- RHSA-2016:2042 vendor-advisory
- RHSA-2016:2043 vendor-advisory
- DSA-3678 third-party-advisory vendor-advisory
- USN-3089-1 third-party-advisory vendor-advisory
- 1036899 third-party-advisory vdb-entry
- 93182 third-party-advisory vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-7401 vendor-advisory