CVE-2011-0698

Related Files

Mandriva Linux Security Advisory 2011-031

Posted Feb 19, 2011

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-031 - Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery attacks via forged AJAX requests that leverage a combination of browser plugins and redirects, a related issue to CVE-2011-0447. Cross-site scripting vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload. Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / character in a key in a session cookie, related to session replays. The updated packages have been upgraded to the 1.1.4 version which is not vulnerable to these issues.

tags | advisory, remote, web, arbitrary, xss, file upload, csrf

systems | linux, windows, mandriva

advisories | CVE-2011-0696, CVE-2011-0697, CVE-2011-0698

SHA-256 | 35b66525c38b4cc2dbc7f00656d49770e63010bc4caa8000a032054d2a571b32

Download | Favorite | View