Description
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Remediation
References
Related Vulnerabilities
Drupal Core 8.5.x Cross-Site Scripting (8.5.0 - 8.5.1)
Microsoft SQL Server Other Vulnerability (CVE-2000-0654)
WordPress Plugin Contact Form Email Cross-Site Scripting (1.1.49)
WordPress Plugin Under Construction Open Redirect (3.20)
Oracle Database Server CVE-2009-2001 Vulnerability (CVE-2009-2001)