Unscored severity · published Sep 4, 2008
CVE-2008-3909
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows…
–
CVSS
0.9%
EPSS
No
On KEV
Description
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DJ
Django · Djangoproject
0.91 before 0.91.3; 0.95 before 0.95.4; 0.96 before 0.96.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3909
Broken Link
http://osvdb.org/47906
Not Applicable
http://secunia.com/advisories/31837
Not Applicable
http://secunia.com/advisories/31961
Third Party Advisory
http://www.debian.org/security/2008/dsa-1640
Patch
http://www.djangoproject.com/weblog/2008/sep/02/security/
Mailing List
http://www.openwall.com/lists/oss-security/2008/09/03/4
More from Django
9.8
CVE-2026-4277
Privilege abuse in GenericInlineModelAdmin
9.8
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7
9.8
CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17
9.8
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files
9.8
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6