FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

django -- cross-site scripting vulnerability

Affected packages
1.2 < py23-django < 1.2.2
1.2 < py24-django < 1.2.2
1.2 < py25-django < 1.2.2
1.2 < py26-django < 1.2.2
1.2 < py30-django < 1.2.2
1.2 < py31-django < 1.2.2
py23-django-devel < 13698,1
py24-django-devel < 13698,1
py25-django-devel < 13698,1
py26-django-devel < 13698,1
py30-django-devel < 13698,1
py31-django-devel < 13698,1

Details

VuXML ID 3ff95dd3-c291-11df-b0dc-00215c6a37bb
Discovery 2010-09-13
Entry 2010-09-17

Django project reports:

The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks.

References

Bugtraq ID 43116
CVE Name CVE-2010-3082
URL http://xforce.iss.net/xforce/xfdb/61729