CVE-2008-3909

EPSS 0.38%
Veröffentlicht 04.09.2008 17:41:00
Zuletzt bearbeitet 16.04.2026 21:11:39
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 13

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Djangoproject ≫ Django Version >= 0.91 < 0.91.3

Djangoproject ≫ Django Version >= 0.95 < 0.95.4

Djangoproject ≫ Django Version >= 0.96 < 0.96.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.38%	0.596

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:N/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://secunia.com/advisories/31961

Not Applicable

http://www.debian.org/security/2008/dsa-1640

Third Party Advisory

http://osvdb.org/47906

Broken Link

http://secunia.com/advisories/31837

Not Applicable

http://www.djangoproject.com/weblog/2008/sep/02/security/

Patch

http://www.openwall.com/lists/oss-security/2008/09/03/4

Third Party Advisory