CVE-2014-0473: CSRF
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.6.3 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.5.6 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.4.11
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0473?
CVE-2014-0473 has a high severity rating due to its potential to allow remote attackers to bypass CSRF protections.
How do I fix CVE-2014-0473?
To fix CVE-2014-0473, upgrade Django to version 1.4.11 or later, 1.5.6 or later, 1.6.3 or later, or any version from 1.7 beta 2 or later.
Which versions of Django are affected by CVE-2014-0473?
Versions of Django affected by CVE-2014-0473 include 1.4 through 1.4.10, all 1.5.x versions prior to 1.5.6, all 1.6.x versions prior to 1.6.3, and 1.7-alpha and 1.7-beta1.
What are the implications of CVE-2014-0473?
The implications of CVE-2014-0473 are that anonymous users could be targeted to bypass CSRF protections, potentially leading to unauthorized actions.
Is there a workaround for CVE-2014-0473?
There are no specific workarounds for CVE-2014-0473; upgrading to a patched version is the recommended action.