CVE-2008-3909: Django Cross-Site Request Forgery (CSRF) Vulnerability
Summary
CVE-2008-3909: Django cross-site request forgery (CSRF) vulnerability. Affects django across 3 version ranges.
>= 0.91.0, < 0.91.3
>= 0.95.0, < 0.95.4
>= 0.96.0, < 0.96.3
Fixed in 0.91.3, 0.95.4 or 0.96.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2008-3909 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a high-level API for handling web requests, managing databases, and rendering templates. The vulnerability affects Django versions 0.91, 0.95, and 0.96. Django's administration application stores unauthenticated HTTP POST requests and processes them after successful authentication, making it susceptible to cross-site request forgery (CSRF) attacks. This allows remote attackers to delete or modify data through unspecified requests.
Vulnerability Detail
The vulnerability in Django's administration application arises from the storage and processing of unauthenticated HTTP POST requests. By exploiting this flaw, remote attackers can conduct CSRF attacks, tricking authenticated users into unknowingly performing malicious actions. This can lead to unauthorized data deletion or modification, potentially compromising the integrity and security of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.91.0, < 0.91.30.91.3pip install --upgrade "django==0.91.3" -
>= 0.95.0, < 0.95.40.95.4pip install --upgrade "django==0.95.4" -
>= 0.96.0, < 0.96.30.96.3pip install --upgrade "django==0.96.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a newer version of Django is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to implement CSRF protection manually by adding a CSRF token to all forms in the application. This can be achieved by including the {% csrf_token %} template tag in the form templates. Additionally, the Django documentation provides detailed guidance on how to implement CSRF protection.
Conclusion
The CSRF vulnerability in Django's administration application can be mitigated by upgrading to Django version 1.1 or later. Implementing CSRF protection is crucial to prevent unauthorized data modification or deletion. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks authenticated users into unknowingly performing malicious actions on a web application. It occurs when an attacker can make a victim's browser send a request to a target website without the victim's consent or knowledge.
This vulnerability affects Django applications that use the administration application and are running versions 0.91, 0.95, or 0.96. It allows remote attackers to conduct CSRF attacks and potentially delete or modify data within the application.
Yes, the vulnerability has been addressed in Django version 1.1 and later. Upgrading to the latest version of Django is the recommended solution to mitigate the risk of CSRF attacks.
Yes, a temporary workaround is to manually implement CSRF protection by adding a CSRF token to all forms in the application. The Django documentation provides detailed instructions on how to implement this protection.
You can find more information about this vulnerability in the Django advisory database. Additionally, the CVE identifier for this vulnerability is CVE-2008-3909.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
