Description

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.

Remediation

References

CVE-2011-4139

Related Vulnerabilities

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33324)

Seo Panel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-28419)

PHP Improper Input Validation Vulnerability (CVE-2012-2336)

WordPress Plugin Badge Designer Lite For WooCommerce includes Backdoor [Only if downloaded via the vendor website] (1.1.0)

ZenCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4567)

Severity

Medium

Classification

CVE-2011-4139 CWE-20

Tags

Missing Update Known Vulnerabilities