PT-2016-7312
CVE-2016-7401
·
Published
2016-09-26
·
Updated
2026-07-14
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Django versions prior to 1.8.15
Django versions 1.9.x prior to 1.9.10
Description
The issue allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies, specifically when used on a site with Google Analytics.
Recommendations
For Django versions prior to 1.8.15, update to version 1.8.15 or later.
For Django versions 1.9.x prior to 1.9.10, update to version 1.9.10 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾