CVE-2008-3909

Опубликовано: 04 сент. 2008

Источник: nvd

CVSS2: 5.8

EPSS Низкий

Описание

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Ссылки

http://osvdb.org/47906
Broken Link
http://secunia.com/advisories/31837
Not Applicable
http://secunia.com/advisories/31961
Not Applicable
http://www.debian.org/security/2008/dsa-1640
Third Party Advisory
http://www.djangoproject.com/weblog/2008/sep/02/security/
Patch
http://www.openwall.com/lists/oss-security/2008/09/03/4
Mailing List
Third Party Advisory
http://www.vupen.com/english/advisories/2008/2533
Not Applicable
https://bugzilla.redhat.com/show_bug.cgi?id=460966
Issue Tracking
Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00091.html
Broken Link
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00131.html
Broken Link
http://osvdb.org/47906
Broken Link
http://secunia.com/advisories/31837
Not Applicable
http://secunia.com/advisories/31961
Not Applicable
http://www.debian.org/security/2008/dsa-1640
Third Party Advisory
http://www.djangoproject.com/weblog/2008/sep/02/security/
Patch
http://www.openwall.com/lists/oss-security/2008/09/03/4
Mailing List
Third Party Advisory
http://www.vupen.com/english/advisories/2008/2533
Not Applicable
https://bugzilla.redhat.com/show_bug.cgi?id=460966
Issue Tracking
Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00091.html
Broken Link
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00131.html
Broken Link

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Версия от 0.91 (включая) до 0.91.3 (исключая)

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Версия от 0.95 (включая) до 0.95.4 (исключая)

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Версия от 0.96 (включая) до 0.96.3 (исключая)

EPSS

Процентиль: 56%

0.00931

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2008-3909

ubuntu

почти 18 лет назад

CVE-2008-3909

debian

почти 18 лет назад

The administration application in Django 0.91, 0.95, and 0.96 stores u ...

GHSA-r5cj-wv24-92p5

CVSS3: 7.5

github

около 4 лет назад

Django cross-site request forgery (CSRF) vulnerability

EPSS

Процентиль: 56%

0.00931

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-352