The administration application in Django 0.91, 0.95, and 0.96 stores
unauthenticated HTTP POST requests and processes them after successful
authentication occurs, which allows remote attackers to conduct cross-site
request forgery (CSRF) attacks and delete or modify data via unspecified
requests.