VulnerabilityAnalyzed
CVE-2008-3909
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and…
MEDIUM 5.8EPSS 0.93%
Does this matter?
Lower severity and a low EPSS score (0.93%). Track it; it rarely justifies an emergency change on its own.
Description
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
- EPSS
- 0.93% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- djangoproject/django
- Source
- cve@mitre.org
References
- http://osvdb.org/47906Broken Link
- http://secunia.com/advisories/31837Not Applicable
- http://secunia.com/advisories/31961Not Applicable
- http://www.debian.org/security/2008/dsa-1640Third Party Advisory
- http://www.djangoproject.com/weblog/2008/sep/02/security/Patch
- http://www.openwall.com/lists/oss-security/2008/09/03/4Mailing List, Third Party Advisory
- http://www.vupen.com/english/advisories/2008/2533Not Applicable
- https://bugzilla.redhat.com/show_bug.cgi?id=460966Issue Tracking, Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00091.htmlBroken Link
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00131.htmlBroken Link
- http://osvdb.org/47906Broken Link
- http://secunia.com/advisories/31837Not Applicable
- http://secunia.com/advisories/31961Not Applicable
- http://www.debian.org/security/2008/dsa-1640Third Party Advisory
- http://www.djangoproject.com/weblog/2008/sep/02/security/Patch
- http://www.openwall.com/lists/oss-security/2008/09/03/4Mailing List, Third Party Advisory
- http://www.vupen.com/english/advisories/2008/2533Not Applicable
- https://bugzilla.redhat.com/show_bug.cgi?id=460966Issue Tracking, Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00091.htmlBroken Link
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00131.htmlBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.