Cross-site request forgery in Django - CVE-2014-0473
Published: April 23, 2014 / Updated: July 28, 2020
Vulnerability identifier: #VU32541
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0473
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
Affected software
Django
Gentoo Linux
Fedora
py-django (Alpine package)
Django14
Gentoo Linux
Fedora
py-django (Alpine package)
Django14
How to mitigate CVE-2014-0473
Update to version 1.7.
Django - update to 1.7
py-django (Alpine package) - update to 1.5.6-r0
Django14 - update to 1.4.11-1.el6
py-django (Alpine package) - update to 1.5.6-r0
Django14 - update to 1.4.11-1.el6
External References
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
- http://rhn.redhat.com/errata/RHSA-2014-0456.html
- http://rhn.redhat.com/errata/RHSA-2014-0457.html
- http://secunia.com/advisories/61281
- http://www.debian.org/security/2014/dsa-2934
- http://www.ubuntu.com/usn/USN-2169-1
- https://www.djangoproject.com/weblog/2014/apr/21/security/