Django CVE-2014-0473 Cross Site Request Forgery Vulnerability

Bugtraq ID:	67040
Class:	Input Validation Error
CVE:	CVE-2014-0473
Remote:	Yes
Local:	No
Published:	Apr 23 2014 12:00AM
Updated:	Apr 13 2015 09:31PM
Credit:	Paul McMillan
Vulnerable:	Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 13.10 Ubuntu Ubuntu Linux 12.10 Ubuntu Ubuntu Linux 12.04 LTS Ubuntu Ubuntu Linux 10.04 LTS Redhat OpenStack 4.0 Redhat OpenStack 3.0 Oracle Solaris 11.2 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM SmartCloud Provisioning 2.3.01 IFix2 IBM SmartCloud Provisioning 2.3.0.1 IFix1 IBM SmartCloud Provisioning 2.3.0.1 IBM SmartCloud Provisioning 2.3 Gentoo Linux Djangoproject Django 1.6.2 Djangoproject Django 1.5.5 Djangoproject Django 1.4.10 Djangoproject Django 1.6 Djangoproject Django 1.5.4 Djangoproject Django 1.5.2 Djangoproject Django 1.5.1 Djangoproject Django 1.4.8 Djangoproject Django 1.4.6 Djangoproject Django 1.4.5 Djangoproject Django 1.4.4 Djangoproject Django 1.4.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Djangoproject Django 1.6.3 Djangoproject Django 1.5.6 Djangoproject Django 1.4.11

Django CVE-2014-0473 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Django CVE-2014-0473 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva python-django-1.3.7-0.3mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva python-django-1.3.7-0.3mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Business Server 1 X86 64

• Mandriva python-django-1.3.7-1.4.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

Django CVE-2014-0473 Cross Site Request Forgery Vulnerability

References:

• Django Homepage (Django)
  
• Multiple vulnerabilities in Django (Oracle)
  
• SmartCloud Provisioning - Django vulnerabilities reported in April 2014 X-Force (IBM)
  
• Django Security Issue and Multiple Vulnerabilities (Django Project)
  
• RHSA-2014:0456-1 Moderate: Django security update (Red Hat)
  
• RHSA-2014:0457-1 Moderate: Django security update (Red Hat)