7.5high
CVE-2008-3909
Django cross-site request forgery (CSRF) vulnerability
Also known as GHSA-r5cj-wv24-92p5, PYSEC-2008-2
Published 18 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · GitHub
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known
Summary
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Exploit prediction (EPSS)
0.92% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=0.91.0, <0.91.3 >=0.95.0, <0.95.4 >=0.96.0, <0.96.3 <1.1 | 0.91.3 0.95.4 0.96.3 1.1 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
- Technology feeds
- Django (RSS, critical only)
References
- secunia.com /advisories/31837 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- djangoproject.com /weblog/2008/sep/02/security/ · x_refsource_CONFIRM, x_transferred
- debian.org /security/2008/dsa-1640 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- redhat.com /archives/fedora-package-announce/2008-September/msg00091.html · vendor-advisory, x_refsource_FEDORA, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=460966 · x_refsource_CONFIRM, x_transferred
- vupen.com /english/advisories/2008/2533 · vdb-entry, x_refsource_VUPEN, x_transferred
- secunia.com /advisories/31961 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- openwall.com /lists/oss-security/2008/09/03/4 · mailing-list, x_refsource_MLIST, x_transferred
- redhat.com /archives/fedora-package-announce/2008-September/msg00131.html · vendor-advisory, x_refsource_FEDORA, x_transferred
- osvdb.org /47906 · vdb-entry, x_refsource_OSVDB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2008-3909 · advisory
- github.com /django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752 · web
- github.com /django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e · web
- github.com /django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81 · web
- github.com /django/django · package
- github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-2.yaml · web
- djangoproject.com /weblog/2008/sep/02/security · web
- github.com /advisories/GHSA-r5cj-wv24-92p5 · advisory
Sources
- CVE List: CVE-2008-3909
- GitHub Advisory: GHSA-r5cj-wv24-92p5
- NVD: CVE-2008-3909
- OSV: PYSEC-2008-2
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.