CVE-2011-4140
Django Cross-Site Request Forgery vulnerability
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Exploit likelihood
What each source reports
NVD Score used
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
CVE-2011-4140- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
CVE-2011-4140- Updated
- 2026-11-02
EUVDEUVD-2011-0010 No score
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
EUVD-2011-0010- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h95j-h2rv-qrg4
Django Cross-Site Request Forgery vulnerability
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
GHSA-h95j-h2rv-qrg4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-h95j-h2rv-qrg4
Django Cross-Site Request Forgery vulnerability
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
GHSA-h95j-h2rv-qrg4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
CVE-2011-4140- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4140 No score
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
DEBIAN-CVE-2011-4140- Updated
- 2026-11-02
OSVPYSEC-2011-5 No score
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
- Record
PYSEC-2011-5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
through 1.2.7 | None known |
djangoPyPI |
1.3 to 1.3.1 | None known |
python-djangoDebian:12 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:13 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:14 |
before 1.3.1-1 | 1.3.1-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze2, plus listed versions 1.2.3-31.2.3-3+squeeze1 |
1.2.3-3+squeeze2 |
python-djangoDebian:5.0 |
before 1.0.2-1+lenny3, plus listed versions 1.0.2-11.0.2-1+lenny11.0.2-1+lenny2 |
1.0.2-1+lenny3 |
djangoPyPI |
through 1.2.7, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 11 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.6 |
None known |
djangoPyPI |
before 1.2.7, 1.3 up to 1.3.1, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 11 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.6 |
1.2.71.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4140 is a medium vulnerability (CVSS 6.8) in Djangoproject Django, published October 19, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in python-django 1.3.1-1.
References
hermes.opensuse.org/messages/14700881
debian.org/security/2011/dsa-2332
bugzilla.redhat.com/show_bug.cgi?id=737366
secunia.com/advisories/46614
openwall.com/lists/oss-security/2011/09/11/1
djangoproject.com/weblog/2011/sep/10/127
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2011-4140
github.com/advisories/GHSA-h95j-h2rv-qrg4
web.archive.org/web/20140806062902/http://secunia.com/advisories/46614
security-tracker.debian.org/tracker/CVE-2011-4140