CVE-2014-0473: Django Reuses Cached CSRF Token – CVSS 5.0 · Watchpost

← All vulnerabilities

Django Reuses Cached CSRF Token

MEDIUM 5.0CVE-2014-0473 · GHSA-89hj-xfx5-7q66 · PYSEC-2014-2 · Published 23/04/2014 · updated 17/06/2026

In short

CVE-2014-0473 is a MEDIUM (CVSS 5.0) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.6% of all vulnerabilities.
Fix: update to 1.5.6, 1.6.3, 1.4.11 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.5, < 1.5.6≥ 1.6, < 1.6.3< 1.4.11`	`1.5.61.6.31.4.11`
django djangoproject	`= 1.4= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.4.9= 1.5= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.6= 1.6.1= 1.6.2= 1.7≤ 1.4.10`	No fix yet

Description

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

NVD description

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

References

nvd.nist.gov/vuln/detail/CVE-2014-0473 · ADVISORY
django/django commit 1170f28 · WEB
django/django commit 6872f42 · WEB
django/django commit d63e209 · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
djangoproject.com/weblog/2014/apr/21/security · WEB
lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · WEB
rhn.redhat.com/errata/RHSA-2014-0456.html · WEB
rhn.redhat.com/errata/RHSA-2014-0457.html · WEB
debian.org/security/2014/dsa-2934 · WEB
ubuntu.com/usn/USN-2169-1

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free