PT-2016-7312 · Django Software Foundation+2 · Django+2

Sergey Bobrov · Published 2016-09-26 · Updated 2026-03-13 · CVE-2016-7401

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.8.15 Django versions 1.9.x prior to 1.9.10

Description The issue allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies, specifically when used on a site with Google Analytics.

Recommendations For Django versions prior to 1.8.15, update to version 1.8.15 or later. For Django versions 1.9.x prior to 1.9.10, update to version 1.9.10 or later.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

ALT-PU-2016-2173

CVE-2016-7401

DLA-649-1

DSA-3678-1

GHSA-CRHM-QPJC-CM64

MGASA-2016-0334

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:11333-1

OPENSUSE-SU-2024:12248-1

OPENSUSE-SU-2024:13158-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14073-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2025:14741-1

OPENSUSE-SU-2026:10005-1

OPENSUSE-SU-2026:10349-1

PYSEC-2016-3

RHSA-2016:2038

RHSA-2016:2039

RHSA-2016:2040

RHSA-2016:2041

RHSA-2016:2042

RHSA-2016:2043

SUSE-SU-2018:0973-1

SUSE-SU-2018:1102-1

USN-3089-1

Affected Products

Alt Linux

Django

Ubuntu

References · 128

• https://ubuntu.com/security/notices/USN-3089-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-3089-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3678 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7401 · Security Note
• https://djangoproject.com/weblog/2016/sep/26/security-releases · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2038.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7401 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7401 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14073-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2043.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2042.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2040.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10005-1 · Vendor Advisory