CVE-2011-0696

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for…

published February 14, 2011

CVSS
—
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01602 · 75.5th percentile
Published
2011-02-14T20:00Z
EPSS history
Timeline
  • 14 FEB 20:00Z
    Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for…
    cvelistv5