CVE-2011-4140: CSRF
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4140?
CVE-2011-4140 is classified as a medium severity vulnerability.
How do I fix CVE-2011-4140?
To fix CVE-2011-4140, upgrade Django to version 1.3.2 or later.
What versions of Django are affected by CVE-2011-4140?
CVE-2011-4140 affects Django versions from 0.91 to 1.3.1, including several intermediate versions.
Can CVE-2011-4140 lead to unauthorized access?
Yes, CVE-2011-4140 can allow attackers to make unauthenticated forged requests, potentially leading to unauthorized access.
Is there a workaround for CVE-2011-4140 if I cannot upgrade?
A potential workaround includes configuring your web server to sanitize HTTP Host headers, although upgrading is strongly recommended.