The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2011-10-19T10:00:00

Updated: 2024-08-07T00:01:51.120Z

Reserved: 2011-10-19T00:00:00

Link: CVE-2011-4140

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2011-10-19T10:55:04.643

Modified: 2024-11-21T01:31:55.587

Link: CVE-2011-4140

cve-icon Redhat

No data.