Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Django on Google Analytics sites can be tricked by malicious cookies

CVE-2016-7401 · published 10 years ago
Summary

If you're using Django and Google Analytics, an attacker could potentially trick your site into allowing unauthorized actions. This is a concern if you're using Django versions 1.8.15 or earlier, or 1.9.x up to 1.9.10. To fix this, update to the latest version of Django.

What to do
  • Update django software foundation django to version 1.8.15.
  • Update django software foundation django to version 1.9.10.
Affected software
Ecosystem VendorProductAffected versions
pip django software foundation django < 1.8.15
>= 1.9, < 1.9.10
Fix: upgrade to 1.8.15
– canonical ubuntu_linux 12.04
14.04
16.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
– djangoproject django <= 1.8.14
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
– debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by settin...
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
6% chance of attack within 30 days
Type
CWE-2547PK - Security Features
Timeline
Published3 Oct 2016
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-crhm-qpjc-cm64 · GHSA
CVE-2016-7401 · NVD
Track software like this
Free during beta