CVE-2011-4140

Django < 1.2.6 - Cross-Site Request Forgery via Arbitrary HTTP Host Header

Title source: llm
STIX 2.1

Description

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

References (8)

Core 8
Core References
Various Sources vendor-advisory x_refsource_suse
https://hermes.opensuse.org/messages/14700881
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2332
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46614
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/09/11/1
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/09/13/2
Patch, Vendor Advisory x_refsource_confirm
https://www.djangoproject.com/weblog/2011/sep/09/

Scores

EPSS 0.0109
EPSS Percentile 61.5%

Details

CWE
CWE-352
Status published
Products (20)
djangoproject/django 0.91
djangoproject/django 0.95
djangoproject/django 0.95.1
djangoproject/django 0.96
djangoproject/django 1.0
djangoproject/django 1.0.1
djangoproject/django 1.0.2
djangoproject/django 1.1
djangoproject/django 1.1.0
djangoproject/django 1.1.2
... and 10 more
Published Oct 19, 2011
Tracked Since Feb 18, 2026