Back to feed
EUVD-2015-0013 · Published May 17, 2022
Django WSGI Header Spoofing Vulnerability Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X-Auth_User` header.
Technologies
Djangoproject DjangoDjango Django
Weaknesses
CWE-17CWE-290
CVSS scores
- v3.15.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://www.djangoproject.com/weblog/2015/jan/13/security/
- http://advisories.mageia.org/MGASA-2015-0026.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148696.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
Potentially impacted assets
See if this affects your attack surface
