CVE-2011-4138 — Django Might Allow CSRF Requests via URL Verification

CVE-2011-4138: Django Might Allow CSRF Requests via URL Verification (2022-05-14)

Risk and impact

The vulnerability allows remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header, potentially leading to cross-site request forgery (CSRF) attacks.

Recommended action

Upgrade to Django 1.2.7 or 1.3.1 to fix the vulnerability. Ensure that all affected installations are updated accordingly.