CVE-2008-3909
MEDIUM severity · CVSS 5.8 · Cross-site request forgery (CSRF)
5.8CVSS MEDIUM
Summary
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impact—
Exploit probability (EPSS)1%
AV:N/AC:M/Au:N/C:N/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://www.djangoproject.com/weblog/2008/sep/02/security/ ↗
Additional information
- NVD record
- http://www.djangoproject.com/weblog/2008/sep/02/security/Patch
- http://osvdb.org/47906
- http://secunia.com/advisories/31837
- http://secunia.com/advisories/31961
- http://www.debian.org/security/2008/dsa-1640Advisory
- http://www.openwall.com/lists/oss-security/2008/09/03/4Advisory
- http://www.vupen.com/english/advisories/2008/2533
- https://bugzilla.redhat.com/show_bug.cgi?id=460966Advisory