Cross site request forgery (csrf)

2011-10-1910:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.1%

JSON

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

CPENameOperatorVersion
djangole1.2.6
djangoeq1.2.5
djangoeq0.95
djangoeq1.0
djangoeq1.3
djangoeq1.1.2
djangoeq1.0.1
djangoeq1.1
djangoeq1.2.1
djangoeq1.2.4