Description

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

Remediation

References

CVE-2015-0219

Related Vulnerabilities

WordPress Plugin URL Cloak & Encrypt Cross-Site Scripting (2.0)

WordPress Plugin HDW Player (Video Player & Video Gallery) SQL Injection (2.4.2)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (5.7.14)

MyBB URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2018-10678)

MyBB Improper Privilege Management Vulnerability (CVE-2018-1000503)

Severity

Medium

Classification

CVE-2015-0219

Tags

Missing Update Known Vulnerabilities