Description

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

Remediation

References

CVE-2015-0219

Related Vulnerabilities

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0794)

phpList CVE-2023-27576 Vulnerability (CVE-2023-27576)

Oracle Application Server Other Vulnerability (CVE-2002-0655)

WordPress Plugin Chained Quiz Cross-Site Scripting (0.9.9)

WordPress Plugin Platinum SEO Pack Cross-Site Scripting (1.3.7)

Severity

Medium

Classification

CVE-2015-0219

Tags

Missing Update Known Vulnerabilities