Description

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Remediation

References

CVE-2016-9014

Related Vulnerabilities

concrete5 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-11476)

Jboss EAP Improper Input Validation Vulnerability (CVE-2020-1757)

Joomla Other Vulnerability (CVE-2006-4473)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-43500)

TCExam Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-4237)

Severity

High

Classification

CVE-2016-9014 CWE-264 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities