Description
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Remediation
References
Related Vulnerabilities
Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33334)
WordPress Plugin MapSVG Lite Arbitrary File Upload (4.0.5)
Oracle Database Server CVE-2024-21184 Vulnerability (CVE-2024-21184)
WebLogic CVE-2019-2647 Vulnerability (CVE-2019-2647)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1135)