PT-2008-5242 · Django · Django

Steve Milner · Publicado 2008-09-04 · Atualizado 2022-05-02 · CVE-2008-3909

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 0.91 through 0.96

Description The administration application in Django stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Recommendations For Django versions 0.91 through 0.96, consider disabling the administration application until a patch is available to prevent cross-site request forgery (CSRF) attacks. Restrict access to the administration interface to minimize the risk of exploitation. Avoid using the administration application for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-3909

DSA-1640-1

GHSA-R5CJ-WV24-92P5

PYSEC-2008-2

Produtos afetados

Django

Referências · 21

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e · Nota
• https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81 · Nota
• https://github.com/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-2.yaml · Nota
• http://debian.org/security/2008/dsa-1640 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00131.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00091.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-3909 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2008-2 · Aviso do Fabricante
• http://djangoproject.com/weblog/2008/sep/02/security · Correção
• http://openwall.com/lists/oss-security/2008/09/03/4 · Nota
• https://osv.dev/vulnerability/GHSA-r5cj-wv24-92p5 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2533 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3909 · Nota de Segurança