CVE-2008-3909 json
Django cross-site request forgery (CSRF) vulnerability
published 2008-09-04 18 y ago modified 2026-06-16 4 mo ago also GHSA-r5cj-wv24-92p5 , PYSEC-2008-2 , EUVD-2008-0003
- cvss
- 7.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Patch / fix
- pypi django 0.91.3, 0.95.4, 0.96.3, 1.1
- djangoproject django 0.91.3, 0.95.4, 0.96.3
- python-django Debian 14, Debian 13, Debian 12 1.0-1
debian advisories DEBIAN-CVE-2008-3909
Exploit prediction
0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=0.91.0, <0.91.3 >=0.95.0, <0.95.4 >=0.96.0, <0.96.3 <1.1 |
0.91.3 0.95.4 0.96.3 1.1 |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
- Technology feeds
References
-
djangoproject.com
/weblog/2008/sep/02/security/
patch, article
-
github.com
/django/django/commit/44debfeaa4473bd28872c735dd3d9afde6886752
web
-
github.com
/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e
web
-
github.com
/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81
web
-
debian.org
/security/2008/dsa-1640
vendor-advisory, web, third-party-advisory, advisory
-
redhat.com
/archives/fedora-package-announce/2008-September/msg00091.html
vendor-advisory, web, broken-link
-
redhat.com
/archives/fedora-package-announce/2008-September/msg00131.html
vendor-advisory, web, broken-link
-
secunia.com
/advisories/31837
third-party-advisory, not-applicable, advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=460966
web, issue-tracking, third-party-advisory, report
-
vupen.com
/english/advisories/2008/2533
vdb-entry, not-applicable, advisory
-
secunia.com
/advisories/31961
third-party-advisory, not-applicable, advisory
-
openwall.com
/lists/oss-security/2008/09/03/4
mailing-list, web, third-party-advisory
-
osvdb.org
/47906
vdb-entry, broken-link, web
-
nvd.nist.gov
/vuln/detail/CVE-2008-3909
advisory
-
github.com
/django/django
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-2.yaml
web
-
djangoproject.com
/weblog/2008/sep/02/security
web
-
github.com
/advisories/GHSA-r5cj-wv24-92p5
advisory
Sources
- CVE List CVE-2008-3909
- GitHub Advisory GHSA-r5cj-wv24-92p5
- NVD CVE-2008-3909
- OSV PYSEC-2008-2
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.