CVE-2015-0219 — Authentication Bypass by Spoofing in Django
CWE-17CWE-290 — Authentication Bypass by SpoofingCWE-20 — Improper Input Validation14 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
4.8%
top 10.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 16
Latest updateMay 17
Description
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
CVSS vector
AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9
Affected Packages2 packages
Patches
🔴Vulnerability Details
5📋Vendor Advisories
3💬Community
5Bugzilla▶
CVE-2015-0219 Django14: Django: WSGI header spoofing via underscore/dash conflation [epel-6]↗2015-01-14
Bugzilla▶
CVE-2015-0219 python-django14: Django: WSGI header spoofing via underscore/dash conflation [fedora-20]↗2015-01-14
Bugzilla▶
CVE-2015-0219 python-django: Django: WSGI header spoofing via underscore/dash conflation [fedora-all]↗2015-01-14
Bugzilla▶
CVE-2015-0219 python-django: Django: WSGI header spoofing via underscore/dash conflation [epel-7]↗2015-01-14