CVE-2014-0473
Django Reuses Cached CSRF Token
CVE-2014-0473 is a medium vulnerability (CVSS 5.0) in Djangoproject Django, published April 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in django 1.4.11.
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
Exploit likelihood
What each source reports
NVD Score used
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
CVE-2014-0473- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
CVE-2014-0473- Updated
- 2026-11-02
EUVDEUVD-2014-0009 No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
EUVD-2014-0009- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89hj-xfx5-7q66
Django Reuses Cached CSRF Token
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
GHSA-89hj-xfx5-7q66- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-89hj-xfx5-7q66
Django Reuses Cached CSRF Token
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
GHSA-89hj-xfx5-7q66- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
CVE-2014-0473- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-0473 No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
DEBIAN-CVE-2014-0473- Updated
- 2026-11-02
OSVMGASA-2014-0196 No score
Updated python-django packages fix multiple vulnerabilities
Updated python-django and python-dgango14 packages fix security vulnerabilities:
Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. (CVE-2014-0472)
Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. (CVE-2014-0473)
Michael Koziarski discovered that Django did not always perform explicit conversion of certain fields when using a MySQL database. An attacker could possibly use this issue to obtain unexpected results. (CVE-2014-0474)
- Record
MGASA-2014-0196- Updated
- 2026-11-02
OSVPYSEC-2014-2 No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
PYSEC-2014-2- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0473 No score
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
- Record
UBUNTU-CVE-2014-0473- Updated
- 2026-11-02
OSVUSN-2169-1 No score
python-django vulnerabilities
Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. (CVE-2014-0472)
Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. (CVE-2014-0473)
Michael Koziarski discovered that Django did not always perform explicit conversion of certain fields when using a MySQL database. An attacker could possibly use this issue to obtain unexpected results. (CVE-2014-0474)
- Record
USN-2169-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
before 1.4.11 | 1.4.11 |
djangoPyPI |
1.5 up to 1.5.6 | 1.5.6 |
djangoPyPI |
1.6 up to 1.6.3 | 1.6.3 |
python-djangoDebian:12 |
before 1.6.3-1 | 1.6.3-1 |
python-djangoDebian:13 |
before 1.6.3-1 | 1.6.3-1 |
python-djangoDebian:14 |
before 1.6.3-1 | 1.6.3-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze10, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze31.2.3-3+squeeze5 Show 4 moreShow less1.2.3-3+squeeze61.2.3-3+squeeze71.2.3-3+squeeze81.2.3-3+squeeze9 |
1.2.3-3+squeeze10 |
python-djangoDebian:7 |
before 1.4.5-1+deb7u7, plus listed versions 1.4.5-11.4.5-1+deb7u11.4.5-1+deb7u21.4.5-1+deb7u31.4.5-1+deb7u4 Show 4 moreShow less1.4.5-1+deb7u4~bpo60+11.4.5-1+deb7u51.4.5-1+deb7u61.4.5-1+deb7u7~bpo60+1 |
1.4.5-1+deb7u7 |
djangoPyPI |
before 1.4.11, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 31 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.9 |
1.4.11 |
djangoPyPI |
1.5 up to 1.5.6, plus listed versions 1.5.11.5.21.5.31.5.41.5.5 |
1.5.6 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.6 up to 1.6.3, plus listed versions 1.6.11.6.2 |
1.6.3 |
python-djangoMageia:3 |
before 1.4.11-1.1.mga3 | 1.4.11-1.1.mga3 |
python-djangoMageia:4 |
before 1.5.6-1.1.mga4 | 1.5.6-1.1.mga4 |
python-django14Mageia:4 |
before 1.4.11-1.1.mga4 | 1.4.11-1.1.mga4 |
djangoPyPI |
before 1.4.11, 1.5 up to 1.5.6, 1.6 up to 1.6.3, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 38 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.11.5.21.5.31.5.41.5.51.6.11.6.2 |
1.4.111.5.61.6.3 |
Django14Red Hat:openstack:4::el6 |
before 0:1.4.11-1.el6ost | 0:1.4.11-1.el6ost |
Django14-docRed Hat:openstack:4::el6 |
before 0:1.4.11-1.el6ost | 0:1.4.11-1.el6ost |
Django14Red Hat:openstack:3::el6 |
before 0:1.4.11-1.el6ost | 0:1.4.11-1.el6ost |
Django14-docRed Hat:openstack:3::el6 |
before 0:1.4.11-1.el6ost | 0:1.4.11-1.el6ost |
python-djangoUbuntu:14.04:LTS |
before 1.6.1-2ubuntu0.1, plus listed versions 1.5.4-1ubuntu11.6-11.6.1-11.6.1-2 |
1.6.1-2ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
ubuntu.com/usn/USN-2169-1
djangoproject.com/weblog/2014/apr/21/security
rhn.redhat.com/errata/RHSA-2014-0457.html
secunia.com/advisories/61281
debian.org/security/2014/dsa-2934
lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Show 33 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-0473
github.com/django/django/commit/1170f285ddd6a94a65f911a27788ba49ca08c0b0
security-tracker.debian.org/tracker/CVE-2014-0473
advisories.mageia.org/MGASA-2014-0196.html
bugs.mageia.org/show_bug.cgi?id=13251
access.redhat.com/errata/RHSA-2014:0456
bugzilla.redhat.com/show_bug.cgi?id=1090588
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0456.json
cve.org/CVERecord?id=CVE-2014-0472
ubuntu.com/security/CVE-2014-0473