CVE-2014-0473 in Django
요약 (영어)
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
예약하다
2013. 12. 19.
공개
2014. 04. 23.
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 13064 | Django Cache 권한 상승 | 264 | 높음 | 공식 수정 | CVE-2014-0473 |