Description

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

Remediation

References

CVE-2015-0219

Related Vulnerabilities

Grafana Improper Authentication Vulnerability (CVE-2021-28148)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Open Redirect (2.0.5)

WordPress Plugin Ultimate Membership Pro Cross-Site Request Forgery (8.6.1)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-10094)

WordPress Plugin WP Super Cache Cross-Site Scripting (1.4.2)

Severity

Medium

Classification

CVE-2015-0219

Tags

Missing Update Known Vulnerabilities