CVE-2014-0473

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous…

published April 23, 2014

CVSS
—
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01990 · 80.5th percentile
Published
2014-04-23T14:00Z
EPSS history
Timeline
  • 23 APR 14:00Z
    The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous…
    cvelistv5