Описание
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | released | 1.2.5-1ubuntu1 |
| hardy | ignored | end of life |
| karmic | released | 1.1.1-1ubuntu1.2 |
| lucid | released | 1.1.1-2ubuntu1.3 |
| maverick | released | 1.2.3-1ubuntu0.2.10.10.2 |
| natty | released | 1.2.5-1ubuntu1 |
| oneiric | released | 1.2.5-1ubuntu1 |
| upstream | released | 1.1.4, 1.2.5-1 |
Показывать по
6.8 Medium
CVSS2
Связанные уязвимости
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly val ...
6.8 Medium
CVSS2