CVE-2008-3909
Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Exploit likelihood
What each source reports
NVD Score used
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
CVE-2008-3909- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
CVE-2008-3909- Updated
- 2026-11-02
EUVDEUVD-2008-0003 No score
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
EUVD-2008-0003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5cj-wv24-92p5
Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
GHSA-r5cj-wv24-92p5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-r5cj-wv24-92p5
Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
GHSA-r5cj-wv24-92p5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
CVE-2008-3909- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3909 No score
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
DEBIAN-CVE-2008-3909- Updated
- 2026-11-02
OSVPYSEC-2008-2 No score
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- Record
PYSEC-2008-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
0.91.0 up to 0.91.3 | 0.91.3 |
djangoPyPI |
0.95.0 up to 0.95.4 | 0.95.4 |
djangoPyPI |
0.96.0 up to 0.96.3 | 0.96.3 |
python-djangoDebian:12 |
before 1.0-1 | 1.0-1 |
python-djangoDebian:13 |
before 1.0-1 | 1.0-1 |
python-djangoDebian:14 |
before 1.0-1 | 1.0-1 |
python-djangoDebian:4.0 From an advisory covering 2 CVEs |
before 0.95.1-1etch2, plus listed versions 0.95.1-10.95.1-1etch1 |
0.95.1-1etch2 |
djangoPyPI |
before 1.1, plus listed versions 1.0.11.0.21.0.31.0.4 |
1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3909 is a medium vulnerability (CVSS 5.8) in Djangoproject Django, published September 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in django 0.91.3.
References
secunia.com/advisories/31837
djangoproject.com/weblog/2008/sep/02/security
debian.org/security/2008/dsa-1640
redhat.com/archives/fedora-package-announce/2008-September/msg00091.html
bugzilla.redhat.com/show_bug.cgi?id=460966
vupen.com/english/advisories/2008/2533
Show 12 moreShow less
openwall.com/lists/oss-security/2008/09/03/4
osvdb.org/47906
nvd.nist.gov/vuln/detail/CVE-2008-3909
github.com/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752
security-tracker.debian.org/tracker/CVE-2008-3909