CVE-2014-0473

Published: Apr 23, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

Affected (28)

Products: Djangoproject: Django · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.5.1
Djangoproject Django	Version 1.5.2
Djangoproject Django	Version 1.5.3
Djangoproject Django	Version 1.5.4
Djangoproject Django	Version 1.5.5
Djangoproject Django	Version 1.5

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.6.1
Djangoproject Django	Version 1.6.2
Djangoproject Django	Version 1.6

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.7 alpha1
Djangoproject Django	Version 1.7 alpha2
Djangoproject Django	Version 1.7 beta1

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Up to 1.4.10
Djangoproject Django	Version 1.4.1
Djangoproject Django	Version 1.4.2
Djangoproject Django	Version 1.4.3
Djangoproject Django	Version 1.4.4
Djangoproject Django	Version 1.4.5
Djangoproject Django	Version 1.4.6
Djangoproject Django	Version 1.4.7
Djangoproject Django	Version 1.4.8
Djangoproject Django	Version 1.4.9
Djangoproject Django	Version 1.4

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.10
Canonical Ubuntu Linux	Version 14.04