Is CVE-2015-5081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-5081 being exploited in the wild.

How severe is CVE-2015-5081?

Low severity, with a CVSS score of 3, published 18 August 2017.

Which products and versions are affected?

django-cms (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.14, GIT:introduced=0,fixed=f77cbc607d6e2a62e63287d37ad320109a2cc78a|ECOSYSTEM:introduced=0,fixed=3.0.14,introduced=3.1,fixed=3.1.1.

Is there a fix for CVE-2015-5081?

Yes. django-cms (PyPI): upgrade to 3.0.14, 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-5081 attacked?

It is attacked over the network.

Am I affected by CVE-2015-5081?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-5081: django-cms CSRF vulnerability in page management

CVE-2015-5081 · Severity: low · CVSS 3 · Published 2017-08-18

django-cms is a popular content management system plugin for Django web applications. This vulnerability allows attackers to exploit cross-site request forgery (CSRF) attacks to trick authenticated administrators into performing unauthorized actions, such as modifying pages or other site content without their knowledge or consent. An attacker could potentially manipulate a privileged user into making unintended changes to the website.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2015-5081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-5081 being exploited in the wild.
How severe is CVE-2015-5081?: Low severity, with a CVSS score of 3, published 18 August 2017.
Which products and versions are affected?: django-cms (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.14, GIT:introduced=0,fixed=f77cbc607d6e2a62e63287d37ad320109a2cc78a|ECOSYSTEM:introduced=0,fixed=3.0.14,introduced=3.1,fixed=3.1.1.
Is there a fix for CVE-2015-5081?: Yes. django-cms (PyPI): upgrade to 3.0.14, 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-5081 attacked?: It is attacked over the network.
Am I affected by CVE-2015-5081?: Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

django-cms (PyPI): upgrade to 3.0.14, 3.1.1 or later
```
pip install "django-cms>=3.1.1"
```

Technical details

The vulnerability is a cross-site request forgery (CSRF) vulnerability (CWE-352) in django-cms versions before 3.0.14 and 3.1.x before 3.1.1. Sensitive admin endpoints handling page management operations, such as `change_template`, `move_page`, and `copy_language`, lacked proper CSRF protection via POST-only decorators (e.g., `@require_POST`). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, silently triggers unintended administrative actions. The fix involves adding CSRF protection decorators to affected endpoints. Patches are available in versions 3.0.14 and 3.1.1 and later.

Affected products

Django CMS django-cms before 3.0.14, 3.1.x before 3.1.1

Identifiers

CVE-2015-5081
GHSA-2pqc-gv8q-pvqv
PYSEC-2017-11

Timeline

2015-06-27: disclosed
2015-06-27: patched: Fixed in versions 3.0.14 and 3.1.1

References

https://github.com/divio/django-cms/commit/f77cbc607d6e2a62e63287d37ad320109a2cc78a

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.