The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| Django(PyPI) | 0.91.0 | 0.91.3 | N/A |
| Django(PyPI) | 0.95.0 | 0.95.4 | N/A |
| Django(PyPI) | 0.96.0 | 0.96.3 | N/A |
CVSS Metrics
