CVE-2015-0219: Medium severity djangoproject Django vulnerability
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-AuthUser header.
Other sources
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-AuthUser header.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0219?
CVE-2015-0219 is considered a medium severity vulnerability that allows header spoofing in Django applications.
How do I fix CVE-2015-0219?
To fix CVE-2015-0219, upgrade Django to version 1.4.18, 1.6.10, or 1.7.3 or later.
What versions of Django are affected by CVE-2015-0219?
CVE-2015-0219 affects Django versions before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3.
What type of attack does CVE-2015-0219 enable?
CVE-2015-0219 enables remote attackers to spoof WSGI headers by improperly using underscore characters.
Is CVE-2015-0219 easy to exploit?
Yes, CVE-2015-0219 can be easily exploited by sending specially crafted HTTP requests to the vulnerable Django application.