CVE-2011-0696

Description

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.

How to fix CVE-2011-0696

To remediate CVE-2011-0696, upgrade the affected package to a fixed version below.

• —upgrade to 1.2.5-1 or later
• —upgrade to 1.2.3-3+squeeze1 or later
• —upgrade to 1.1.4 or later
• —upgrade to 1.1.4 or later
• —no fix listed

Is CVE-2011-0696 being exploited?

Low — EPSS is 2.8%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.2.5-1
• from 0, < 1.2.3-3+squeeze1
• >= 1.1, < 1.1.4
• >= 1.1, < 1.1.4, >= 1.2, < 1.2.5

CVSS scores

References (27)

• ADVISORYgithub.com/advisories/GHSA-5j2h-h5hg-3wf8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2011-0696
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2011-0696
• ADVISORYwww.djangoproject.com/weblog/2011/feb/08/security/
• PATCH