Is CVE-2011-0696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2011-0696 being exploited in the wild.

How severe is CVE-2011-0696?

High severity, with a CVSS score of 7.5, published 23 July 2018.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=1.1,fixed=1.1.4, ECOSYSTEM:introduced=1.1,fixed=1.1.4,introduced=1.2,fixed=1.2.5, ECOSYSTEM:introduced=1.1,fixed=1.1.4|ECOSYSTEM:introduced=1.2,fixed=1.2.5.

Is there a fix for CVE-2011-0696?

Yes. Django (PyPI): upgrade to 1.1.4, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2011-0696 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2011-0696?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2011-0696: Django CSRF protection bypass via X-Requested-With header

CVE-2011-0696 · Severity: high · CVSS 7.5 · Published 2018-07-23

Django, a popular web framework for Python, was found to have a security flaw in how it handles certain web requests. This vulnerability could allow an attacker to trick a user's browser into performing unauthorized actions on a website where they are logged in. This could lead to unauthorized data modifications or account changes without the user's knowledge.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2011-0696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2011-0696 being exploited in the wild.
How severe is CVE-2011-0696?: High severity, with a CVSS score of 7.5, published 23 July 2018.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=1.1,fixed=1.1.4, ECOSYSTEM:introduced=1.1,fixed=1.1.4,introduced=1.2,fixed=1.2.5, ECOSYSTEM:introduced=1.1,fixed=1.1.4|ECOSYSTEM:introduced=1.2,fixed=1.2.5.
Is there a fix for CVE-2011-0696?: Yes. Django (PyPI): upgrade to 1.1.4, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-0696 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2011-0696?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 1.1.4, 1.2.5 or later
```
pip install "Django>=1.2.5"
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Django versions 1.1.x (before 1.1.4) and 1.2.x (before 1.2.5). The framework failed to properly validate HTTP requests containing the 'X-Requested-With' header, which was previously relied upon to identify AJAX requests that were thought to be immune to CSRF. Attackers can bypass this protection using a combination of browser plugins and redirects to forge AJAX requests. This allows a remote attacker to perform state-changing actions on behalf of an authenticated user. The issue is resolved in Django versions 1.1.4 and 1.2.5.

Affected products

Django Django >= 1.1, < 1.1.4; >= 1.2, < 1.2.5

Identifiers

CVE-2011-0696
GHSA-5j2h-h5hg-3wf8
PYSEC-2011-10
PYSEC-2011-30

Timeline

2011-02-08: advisory: Django security release announcement
2011-02-14: disclosed: NVD publication date
2018-07-23: other: GitHub Advisory Database publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.