CVE-2011-4140
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h95j-h2rv-qrg4 | PyPI | django | <=1.2.7 | no fix published |
| GHSA-h95j-h2rv-qrg4 | PyPI | django | >=1.3 <=1.3.1 | no fix published |
| PYSEC-2011-5 | PyPI | django | <1.2.7 >=1.3 <1.3.1 | 1.2.7, 1.3.1 |