CVE-2007-5828
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96...
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
Exploit likelihood
What each source reports
NVD Score used
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
- Record
CVE-2007-5828- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
- Record
CVE-2007-5828- Updated
- 2026-11-02
EUVDEUVD-2007-5798 No score
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
- Record
EUVD-2007-5798- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjc8-j97x-hp3p No score
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96...
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.
- Record
GHSA-pjc8-j97x-hp3p- Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
- Record
CVE-2007-5828- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5828 No score
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module
- Record
DEBIAN-CVE-2007-5828- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-djangoDebian:12 |
before 1.2.1 | 1.2.1 |
python-djangoDebian:13 |
before 1.2.1 | 1.2.1 |
python-djangoDebian:14 |
before 1.2.1 | 1.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5828 is a medium vulnerability (CVSS 6.8) in Django Project Django, published November 5, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in python-django 1.2.1.