NetSight
IP …
high7.5

CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intend…

Impact

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04
DjangoprojectDjango
through 1.8.14
Versions 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4
DebianDebian Linux
Version 8.0

Weakness classification

CWE-254

References