CVE-2016-7401

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-09-26T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-3678", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3678"}, {"name": "RHSA-2016:2040", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2040.html"}, {"name": "RHSA-2016:2043", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2043.html"}, {"name": "1036899", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1036899"}, {"name": "RHSA-2016:2041", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2041.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"}, {"name": "RHSA-2016:2042", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2042.html"}, {"name": "USN-3089-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-3089-1"}, {"name": "93182", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/93182"}, {"name": "RHSA-2016:2038", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2038.html"}, {"name": "RHSA-2016:2039", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2039.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-7401", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-3678", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3678"}, {"name": "RHSA-2016:2040", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2040.html"}, {"name": "RHSA-2016:2043", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2043.html"}, {"name": "1036899", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036899"}, {"name": "RHSA-2016:2041", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2041.html"}, {"name": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/", "refsource": "CONFIRM", "url": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"}, {"name": "RHSA-2016:2042", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2042.html"}, {"name": "USN-3089-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3089-1"}, {"name": "93182", "refsource": "BID", "url": "http://www.securityfocus.com/bid/93182"}, {"name": "RHSA-2016:2038", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2038.html"}, {"name": "RHSA-2016:2039", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2039.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:57:47.529Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3678", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3678"}, {"name": "RHSA-2016:2040", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2040.html"}, {"name": "RHSA-2016:2043", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2043.html"}, {"name": "1036899", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1036899"}, {"name": "RHSA-2016:2041", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2041.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"}, {"name": "RHSA-2016:2042", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2042.html"}, {"name": "USN-3089-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-3089-1"}, {"name": "93182", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/93182"}, {"name": "RHSA-2016:2038", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2038.html"}, {"name": "RHSA-2016:2039", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2039.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-7401", "datePublished": "2016-10-03T18:00:00.000Z", "dateReserved": "2016-09-09T00:00:00.000Z", "dateUpdated": "2024-08-06T01:57:47.529Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "66FE8806-7FCB-4CFD-9EAF-05F2ED9F6B9B", "versionEndIncluding": "1.8.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "E4BDA562-AB2E-457C-8DA5-32AB90CB5E3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "6B754401-8503-4553-853F-4F6BCD2D2FF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "019C26C7-EF1F-45BB-934E-521E2E64452E", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "A18691A7-E4D0-48A4-81A7-89846E991AF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "7C06EBD9-381E-4018-BFDC-E23EA18097B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "7D134048-B64F-45AE-B4A2-26E516CCF37B", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "0F39B83A-C10B-4B88-9491-2FB8B07D6EA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*", "matchCriteriaId": "64A4030E-F51F-4944-BCE7-E27CD32EC7D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*", "matchCriteriaId": "CCC1F046-DAF7-4734-9F80-A3C57857AF18", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*", "matchCriteriaId": "61EE8536-0E8D-477A-B8EA-817CE21D516A", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."}, {"lang": "es", "value": "El c\u00f3digo de an\u00e1lisis de cookie en Django en versiones anteriores a 1.8.15 y 1.9.x en versiones anteriores a 1.9.10, cuando se utiliza en un sitio con Google Analytics, permite a atacantes remotos eludir un mecanismo de protecci\u00f3n CSRF destinado estableciendo cookies arbitrarias."}], "id": "CVE-2016-7401", "lastModified": "2026-06-17T00:52:59.777", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-10-03T18:59:13.137", "references": [{"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2038.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2039.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2040.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2041.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2042.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2016-2043.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2016/dsa-3678"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.securityfocus.com/bid/93182"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.securitytracker.com/id/1036899"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-3089-1"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2038.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2039.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2040.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2041.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2042.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2043.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2016/dsa-3678"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.securityfocus.com/bid/93182"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.securitytracker.com/id/1036899"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-3089-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2016/sep/26/security-releases/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-254"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the upstream Django project for reporting this issue.", "affected_release": [{"advisory": "RHSA-2016:2038", "cpe": "cpe:/a:redhat:openstack:5::el6", "package": "python-django-0:1.6.11-6.el6ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6", "release_date": "2016-10-10T00:00:00Z"}, {"advisory": "RHSA-2016:2039", "cpe": "cpe:/a:redhat:openstack:5::el7", "package": "python-django-0:1.6.11-6.el7ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7", "release_date": "2016-10-10T00:00:00Z"}, {"advisory": "RHSA-2016:2040", "cpe": "cpe:/a:redhat:openstack:6::el7", "package": "python-django-0:1.6.11-6.el7ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7", "release_date": "2016-10-10T00:00:00Z"}, {"advisory": "RHSA-2016:2041", "cpe": "cpe:/a:redhat:openstack:7::el7", "package": "python-django-0:1.8.15-1.el7ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7", "release_date": "2016-10-10T00:00:00Z"}, {"advisory": "RHSA-2016:2042", "cpe": "cpe:/a:redhat:openstack:8::el7", "package": "python-django-0:1.8.15-1.el7ost", "product_name": "Red Hat OpenStack Platform 8.0 (Liberty)", "release_date": "2016-10-10T00:00:00Z"}, {"advisory": "RHSA-2016:2043", "cpe": "cpe:/a:redhat:openstack:9::el7", "package": "python-django-0:1.8.15-1.el7ost", "product_name": "Red Hat OpenStack Platform 9.0 (Mitaka)", "release_date": "2016-10-10T00:00:00Z"}], "bugzilla": {"description": "python-django: CSRF protection bypass on a site with Google Analytics", "id": "1377376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377376"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-352", "details": ["The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.", "A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavior and to mitigate this attack. ''request.COOKIES'' may now contain cookies that are invalid according to RFC 6265 but are possible to set using ''document.cookie''."], "name": "CVE-2016-7401", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:1.3", "fix_state": "Not affected", "package_name": "Django", "product_name": "Red Hat Ceph Storage 1.3"}, {"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/a:redhat:openstack-optools:7", "fix_state": "Will not fix", "package_name": "python-django", "product_name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack-optools:10", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 10 (Newton) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack-optools:8", "fix_state": "Will not fix", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 8 (Liberty) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack-optools:9", "fix_state": "Will not fix", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 9 (Mitaka) Operational Tools"}, {"cpe": "cpe:/a:rhel_sam:1", "fix_state": "Not affected", "package_name": "Django", "product_name": "Red Hat Subscription Asset Manager"}], "public_date": "2016-09-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-7401\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7401"], "statement": "This issue did not affect the versions of calamari-server as shipped with Red Hat Ceph Storage 1.3 and 2.0 as they did not include support for google analytics with Django.", "threat_severity": "Moderate"}

{}