CVE-2011-4140: Djangoproject Django

Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

Affected products

• Djangoproject Django: up to and including 1.2.6; version 0.91 only; version 0.95 only; version 0.95.1 only; version 0.96 only; version 1.0 only; …

Published 2011-10-19. Last modified 2026-06-16.