# CVE-2011-0696: Django CSRF protection bypass via X-Requested-With header

Source: https://junglewise.ai/threats/cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-23. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2011-0696 · Severity: high · CVSS 7.5 · Published 2018-07-23

Django, a popular web framework for Python, was found to have a security flaw in how it handles certain web requests. This vulnerability could allow an attacker to trick a user's browser into performing unauthorized actions on a website where they are logged in. This could lead to unauthorized data modifications or account changes without the user's knowledge.

Technologies: [Django (PyPI)](https://junglewise.ai/threats/technologies/django). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2011-0696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2011-0696 being exploited in the wild.

**How severe is CVE-2011-0696?** High severity, with a CVSS score of 7.5, published 23 July 2018.

**Which products and versions are affected?** Django (PyPI) ECOSYSTEM:introduced=1.1,fixed=1.1.4, ECOSYSTEM:introduced=1.1,fixed=1.1.4,introduced=1.2,fixed=1.2.5, ECOSYSTEM:introduced=1.1,fixed=1.1.4|ECOSYSTEM:introduced=1.2,fixed=1.2.5.

**Is there a fix for CVE-2011-0696?** Yes. Django (PyPI): upgrade to 1.1.4, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2011-0696 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2011-0696?** Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Django (PyPI): upgrade to 1.1.4, 1.2.5 or later

  ```sh
  pip install "Django>=1.2.5"
  ```


## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Django versions 1.1.x (before 1.1.4) and 1.2.x (before 1.2.5). The framework failed to properly validate HTTP requests containing the 'X-Requested-With' header, which was previously relied upon to identify AJAX requests that were thought to be immune to CSRF. Attackers can bypass this protection using a combination of browser plugins and redirects to forge AJAX requests. This allows a remote attacker to perform state-changing actions on behalf of an authenticated user. The issue is resolved in Django versions 1.1.4 and 1.2.5.

## Affected products

- Django Django >= 1.1, < 1.1.4; >= 1.2, < 1.2.5

## Identifiers

- CVE-2011-0696
- GHSA-5j2h-h5hg-3wf8
- PYSEC-2011-10
- PYSEC-2011-30

## Timeline

- 2011-02-08: advisory: Django security release announcement
- 2011-02-14: disclosed: NVD publication date
- 2018-07-23: other: GitHub Advisory Database publication date

## References

- [https://api.github.com/users/MarkLee131](https://api.github.com/users/MarkLee131)
- [https://github.com/MarkLee131](https://github.com/MarkLee131)
- [https://api.github.com/users/MarkLee131/gists%7B/gist_id%7D](https://api.github.com/users/MarkLee131/gists%7B/gist_id%7D)
- [https://api.github.com/users/MarkLee131/repos](https://api.github.com/users/MarkLee131/repos)
- [https://avatars.githubusercontent.com/u/38575222?v=4](https://avatars.githubusercontent.com/u/38575222?v=4)
- [https://api.github.com/users/MarkLee131/events%7B/privacy%7D](https://api.github.com/users/MarkLee131/events%7B/privacy%7D)

## Related threats

- [Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service)
- [Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery)
- [PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability)
- [PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives)
- [Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline)