NetSight
IP …
medium5.0

CVE-2014-0473

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous…

Impact

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

Affected products

VendorProductAffected versions
DjangoprojectDjango
Versions 1.5, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5
CanonicalUbuntu Linux
Versions 10.04, 12.04, 12.10, 13.10, 14.04

Weakness classification

CWE-264

References