PT-2008-5242 · Django · Django

Steve Milner · Published 2008-09-04 · Updated 2022-05-02 · CVE-2008-3909

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 0.91 through 0.96

Description The administration application in Django stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Recommendations For Django versions 0.91 through 0.96, consider disabling the administration application until a patch is available to prevent cross-site request forgery (CSRF) attacks. Restrict access to the administration interface to minimize the risk of exploitation. Avoid using the administration application for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-3909

DSA-1640-1

GHSA-R5CJ-WV24-92P5

PYSEC-2008-2

Affected Products

Django

References · 21

• http://debian.org/security/2008/dsa-1640 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00131.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00091.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3909 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2008-2 · Vendor Advisory
• http://djangoproject.com/weblog/2008/sep/02/security · Patch
• https://osv.dev/vulnerability/GHSA-r5cj-wv24-92p5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3909 · Security Note
• https://osv.dev/vulnerability/CVE-2008-3909 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3909 · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e · Note
• https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81 · Note
• https://github.com/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-2.yaml · Note