Published: 03/10/2016 Updated: 05/01/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The cookie parsing code in Django prior to 1.8.15 and 1.9.x prior to 1.9.10, when used on a site with Google Analytics, allows remote malicious users to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
djangoproject django 1.9.6
djangoproject django 1.9.5
djangoproject django 1.9.4
djangoproject django 1.9.3
djangoproject django 1.9.2
djangoproject django 1.9.9
djangoproject django 1.9.1
djangoproject django 1.9.0
djangoproject django 1.9.8
djangoproject django 1.9.7
djangoproject django
debian debian linux 8.0

Django could be made to set arbitrary cookies ...

Sergey Bobrov discovered that cookie parsing in Django and Google Analytics interacted such a way that an attacker could set arbitrary cookies This allows other malicious web sites to bypass the Cross-Site Request Forgery (CSRF) protections built into Django For the stable distribution (jessie), this problem has been fixed in version 1711-1+deb ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 50 (Icehouse) for RHEL 6Red Hat Product Security has rated this update as having a security impact of Moderate A Co ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform 80 (Liberty)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sy ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform 90 (Mitaka)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sys ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 60 (Juno) for RHEL 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 50 (Icehouse) for RHEL 7Red Hat Product Security has rated this update as having a security impact of Moderate A Co ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 70 (Kilo) for RHEL 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common ...

A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection In this update, the parser for ''requestCOOKIES'' has been simplified to better match browser behavior and to mitigate this attack ''requestCOOKIES'' m ...

Sergey Bobrov found a vulnerability where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection ...

CWE-254 http://www.securitytracker.com/id/1036899 https://www.djangoproject.com/weblog/2016/sep/26/security-releases/http://www.debian.org/security/2016/dsa-3678 http://www.securityfocus.com/bid/93182 http://www.ubuntu.com/usn/USN-3089-1 http://rhn.redhat.com/errata/RHSA-2016-2043.html http://rhn.redhat.com/errata/RHSA-2016-2042.html http://rhn.redhat.com/errata/RHSA-2016-2041.html http://rhn.redhat.com/errata/RHSA-2016-2040.html http://rhn.redhat.com/errata/RHSA-2016-2039.html http://rhn.redhat.com/errata/RHSA-2016-2038.html https://usn.ubuntu.com/3089-1/https://nvd.nist.gov

Get Started

CVE-2016-7401

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect