{"id":"CVE-2011-0696","published":"2011-02-14T20:00:00Z","modified":"2024-08-06T21:58:26Z","title":"Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an…","vendor":null,"product":null,"tier":"tail","description":{"text":"Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a \"combination of browser plugins and redirects,\" a related issue to CVE-2011-0447.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01602,"percentile":0.75729,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/43297","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/43382","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2011/0439","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2011/0429","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://openwall.com/lists/oss-security/2011/02/09/6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/43230","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/43426","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=676357","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2011/0372","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2011/0441","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.ubuntu.com/usn/USN-1066-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/46296","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:031","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www.debian.org/security/2011/dsa-2163","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.djangoproject.com/weblog/2011/feb/08/security/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2011/0388","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":15.1,"factors":[{"name":"EPSS percentile","points":15.15}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.1, <1.1.4",">=1.2, <1.2.5"],"patched":["1.1.4","1.2.5"],"from":["GHSA-5j2h-h5hg-3wf8","PYSEC-2011-10"],"provenance":"source"}],"euvd":{"id":"EUVD-2011-0004","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2010-3082","parents":[{"from":"CVE-2010-3082","to":"CVE-2011-0696","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/middleware/csrf.py"],"commits":["https://github.com/django/django/commit/7f84657b6b2243cc787bdb9f296710c8d13ad0bd","https://github.com/django/django/commit/408c5c873ce1437c7eee9544ff279ecbad7e150a","https://github.com/django/django/commit/818e70344e7193f6ebc73c82ed574e6ce3c91afc"],"basis":"rarely changed file"}]},{"from":"CVE-2011-0447","to":"CVE-2011-0696","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.","from":"CVE.org","in":"CVE-2011-0447"}]}],"packageHistory":[{"cve":"CVE-2010-3082","published":"2010-09-14","fixed":"1.2.2","kev":false},{"cve":"CVE-2010-4534","published":"2011-01-10","fixed":"1.2.4","kev":false,"link":{"from":"CVE-2010-4534","to":"CVE-2011-0696","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.1.3","toFixed":"1.1.4","daysApart":35}]}},{"cve":"CVE-2010-4535","published":"2011-01-10","fixed":"1.2.4","kev":false},{"cve":"CVE-2011-0696","published":"2011-02-14","fixed":"1.2.5","kev":false},{"cve":"CVE-2011-0697","published":"2011-02-14","fixed":"1.2.5","kev":false},{"cve":"CVE-2011-0698","published":"2011-02-14","fixed":"1.2.5","kev":false},{"cve":"CVE-2011-4136","published":"2011-10-19","fixed":"1.3.1","kev":false}],"package":"PyPI:Django"}}