Description
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.2.1 | — |
| Debian 13 | python-django | 1.2.1 | — |
| Debian 12 | python-django | 1.2.1 | — |
References
- 20071029 Django 0.96 (stable) Admin Panel CSRF mailing-list
- 3338 third-party-advisory
- 45285 vdb-entry