FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

django -- cross-site scripting vulnerability

Affected packages
1.2	<	py23-django	<	1.2.2
1.2	<	py24-django	<	1.2.2
1.2	<	py25-django	<	1.2.2
1.2	<	py26-django	<	1.2.2
1.2	<	py30-django	<	1.2.2
1.2	<	py31-django	<	1.2.2
		py23-django-devel	<	13698,1
		py24-django-devel	<	13698,1
		py25-django-devel	<	13698,1
		py26-django-devel	<	13698,1
		py30-django-devel	<	13698,1
		py31-django-devel	<	13698,1

Details

VuXML ID	3ff95dd3-c291-11df-b0dc-00215c6a37bb
Discovery	2010-09-13
Entry	2010-09-17

Django project reports:

The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks.

[source]

References

Bugtraq ID	43116
CVE Name	CVE-2010-3082
URL	http://xforce.iss.net/xforce/xfdb/61729