CVE-2014-0473: Django - Reuse of CSRF Token for Anonymous Users
Summary
CVE-2014-0473: Django Reuses Cached CSRF Token. Affects django across 3 version ranges.
< 1.4.11
>= 1.5, < 1.5.6
>= 1.6, < 1.6.3
Fixed in 1.4.11, 1.5.6 or 1.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2014-0473 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes a caching framework that allows developers to store frequently accessed data in memory for faster retrieval. This caching framework is used to improve the performance of Django applications. However, prior to versions 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2, Django's caching framework had a vulnerability that could be exploited by remote attackers to bypass Cross-Site Request Forgery (CSRF) protections for anonymous users.
Vulnerability Detail
The vulnerability in Django's caching framework allowed remote attackers to bypass CSRF protections by reusing a cached CSRF token for all anonymous users. CSRF is a type of attack where an attacker tricks a user into performing an unwanted action on a website without their knowledge or consent. Django's CSRF protections are designed to prevent this type of attack by generating a unique CSRF token for each user session. However, due to the caching framework's behavior, the same CSRF token was used for all anonymous users, making it possible for an attacker to read the CSRF cookie and bypass the CSRF protections.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.111.4.11pip install --upgrade "django==1.4.11" -
>= 1.5, < 1.5.61.5.6pip install --upgrade "django==1.5.6" -
>= 1.6, < 1.6.31.6.3pip install --upgrade "django==1.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately possible, a temporary workaround is to disable caching for anonymous users. This can be done by modifying the Django application's caching settings to exclude anonymous users from caching. Here is an example of how to modify the caching settings in Django's settings.py file:
# settings.py
# Disable caching for anonymous users
CACHE_MIDDLEWARE_ANONYMOUS_ONLY = True
# Other caching settings...
Conclusion
The vulnerability in Django's caching framework allowed remote attackers to bypass CSRF protections for anonymous users. To mitigate this vulnerability, it is crucial to upgrade Django to the recommended versions or apply the provided workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
CSRF (Cross-Site Request Forgery) is a type of attack where an attacker tricks a user into performing an unwanted action on a website without their knowledge or consent. It is important to protect against CSRF attacks to prevent unauthorized actions and maintain the security of web applications.
Django's CSRF protection works by generating a unique CSRF token for each user session. This token is included in forms and requests, and is validated by the server to ensure that the request is legitimate and not a result of a CSRF attack.
The reuse of a CSRF token for all anonymous users can allow an attacker to bypass CSRF protections and perform unauthorized actions on behalf of anonymous users. This could lead to various security issues, such as unauthorized data modifications, account hijacking, or privilege escalation.
No, this vulnerability specifically affects anonymous users. Authenticated users have their own unique CSRF tokens, so they are not impacted by the reuse of CSRF tokens for anonymous users.
There is no specific evidence of this vulnerability being exploited in the wild. However, it is recommended to apply the necessary fixes and security updates to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
