CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of…

published January 16, 2015

CVSS
—
EPSS
7%
Percentile
94.1
In the wild
Unconfirmed
What it is

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06969 · 94.1th percentile
Published
2015-01-16T16:00Z
EPSS history
Timeline
  • 16 JAN 16:00Z
    Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of…
    cvelistv5