Skip to main content

DEPRECATED: Code

CVE-2015-0219

Medium
5/10

Summary

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header. Branch 1.5.x and branches older than 1.4.x are unsupported and might be vulnerable as well.

  • LOW
  • NETWORK
  • NONE
  • PARTIAL
  • NONE
  • NONE

CWE-17 - DEPRECATED: Code

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

References

Advisory Timeline

  • Published