| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 1.9, < 1.9.10< 1.8.15 | 1.9.101.8.15 |
| django | = 1.9.0= 1.9.1= 1.9.2= 1.9.3= 1.9.4= 1.9.5= 1.9.6= 1.9.7= 1.9.8= 1.9.9≤ 1.8.14 |
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free