CVE-2007-5828: CSRF

Published Nov 5, 2007

Updated

DISPUTED Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.

Affected Software

1 affected component

Django Project Django=0.96

Event History

Nov 5, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Disputed

07:46 PM

Frequently Asked Questions

What is the severity of CVE-2007-5828?

CVE-2007-5828 has been disputed in severity but is categorized as a cross-site request forgery (CSRF) vulnerability.

How do I fix CVE-2007-5828?

To fix CVE-2007-5828, consider upgrading Django to a more secure version that addresses this vulnerability.

Who is affected by CVE-2007-5828?

Users of Django version 0.96 are affected by CVE-2007-5828.

What type of vulnerability is CVE-2007-5828?

CVE-2007-5828 is classified as a cross-site request forgery (CSRF) vulnerability.

Can I still use Django 0.96 after CVE-2007-5828?

Using Django 0.96 is risky due to CVE-2007-5828, and it is advisable to upgrade to a secure version.