NVD

Id
10657  
Name
CVE-2011-4140  
Description
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-10-19  
Modified Date
2012-01-26  
Seq
2011-4140  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60274 10657 CVE-2011-4140 [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws  View
60275 10657 CVE-2011-4140 [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws  View
60276 10657 CVE-2011-4140 DSA-2332  View
60277 10657 CVE-2011-4140 https://bugzilla.redhat.com/show_bug.cgi?id=737366  View
60278 10657 CVE-2011-4140 https://www.djangoproject.com/weblog/2011/sep/09/  View
60279 10657 CVE-2011-4140 https://www.djangoproject.com/weblog/2011/sep/10/127/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32266 JVNDB-2011-002506 Django の CSRF 保護メカニズムにおける認証されずに偽造されたリクエストを誘発される脆弱性 Django の CSRF 保護メカニズムには、HTTP Host ヘッダをサポートする Web サーバの設定を適切に処理しないため、認証されずに偽造されたリクエストを誘発される脆弱性が存在します。 CVE-2011-4140 52047 CVE-2011-4140 10657 6.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002506.html 2011-09-09 2011-10-25 View