GHSA-7qfw-j7hp-v45gMediumCVSS 5.3

Django WSGI Header Spoofing Vulnerability

Published
May 17, 2022
Last Modified
September 18, 2024

🔗 CVE IDs covered (1)

CVE-2015-0219 →

📋 Description

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

🎯 Affected products3

  • pip/django:< 1.4.18
  • pip/Django:>= 1.6, < 1.6.10
  • pip/Django:>= 1.7, < 1.7.3

🔗 References (20)