| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 1.5, < 1.5.6≥ 1.6, < 1.6.3< 1.4.11 | 1.5.61.6.31.4.11 |
| django | = 1.4= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.4.9= 1.5= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.6= 1.6.1= 1.6.2= 1.7≤ 1.4.10 |
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free