CVE-2016-7401

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-7401
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7401.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-7401
Aliases
Downstream
DEBIAN (1)
MGASA (1)
openSUSE (13)
RHSA (6)
SUSE (2)
UBUNTU (1)
Related
openSUSE (13)
SUSE (2)
Published
2016-10-03T18:59:13Z
Modified
2026-10-20T10:47:39Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "12.04"
                        },
                        {
                            "last_affected":  "12.04"
                        },
                        {
                            "introduced":  "14.04"
                        },
                        {
                            "last_affected":  "14.04"
                        },
                        {
                            "introduced":  "16.04"
                        },
                        {
                            "last_affected":  "16.04"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.0"
                        },
                        {
                            "last_affected":  "8.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:a:djangoproject:django:1.9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.9.0"
                        },
                        {
                            "last_affected":  "1.9.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "djangoproject:django"
        }
    ]
}
References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
9fbdc48c493f43961173bab8f23d633ab41a9608
Introduced
e70a309c428cfd4e600dc9fa0c7269b1e7a8efcd
Last Affected
e8bb7464c562388da48bca04c5996fe16a0c3619
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.8.14"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.1"
                },
                {
                    "last_affected":  "1.9.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.2"
                },
                {
                    "last_affected":  "1.9.2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.3"
                },
                {
                    "last_affected":  "1.9.3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.4"
                },
                {
                    "last_affected":  "1.9.4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.5"
                },
                {
                    "last_affected":  "1.9.5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.6"
                },
                {
                    "last_affected":  "1.9.6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.7"
                },
                {
                    "last_affected":  "1.9.7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.8"
                },
                {
                    "last_affected":  "1.9.8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.9.9"
                },
                {
                    "last_affected":  "1.9.9"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*
1.0
1.1
1.2
1.2.1
1.3
1.4
1.7a2
1.8
1.8.1
1.8.10
1.8.11
1.8.12
1.8.13
1.8.14
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8a1
1.8b1
1.8b2
1.8c1
1.9
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
1.9b1
1.9rc1
1.9rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7401.json"