Web application abuses : Django 1.11.x < 1.11.22, 2.1.x < 2.1.10, 2.2.x < 2.2.3 Insecure HTTP Handling Vulnerability (Windows)

Anfälligkeitssuche		Suche in 219043 CVE Beschreibungen und 99761 Test Beschreibungen, Zugriff auf 10,000+ Quellverweise.
	Tests CVE Alle

Test Kennung: 1.3.6.1.4.1.25623.1.0.113424

Kategorie: Web application abuses

Titel: Django 1.11.x < 1.11.22, 2.1.x < 2.1.10, 2.2.x < 2.2.3 Insecure HTTP Handling Vulnerability (Windows)

Zusammenfassung: Django is prone to insecure handling of HTTP requests.

Beschreibung: Summary:
Django is prone to insecure handling of HTTP requests.

Vulnerability Insight:
An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and
SECURE_SSL_REDIRECT settings are used and the proxy connects to Django via HTTPS.
In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Vulnerability Impact:
Successful exploitation may allow a man-in-the-middle attacker to read sensitive information.

Affected Software/OS:
Django versions 1.11.0 through 1.11.21, 2.1.0 through 2.1.9 and 2.2.0 through 2.2.2.

Solution:
Update to version 1.11.22, 2.1.10 or 2.2.3 respectively.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2019-12781

Copyright Copyright (C) 2019 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.
Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.

Test Kennung:	1.3.6.1.4.1.25623.1.0.113424
Kategorie:	Web application abuses
Titel:	Django 1.11.x < 1.11.22, 2.1.x < 2.1.10, 2.2.x < 2.2.3 Insecure HTTP Handling Vulnerability (Windows)
Zusammenfassung:	Django is prone to insecure handling of HTTP requests.
Beschreibung:	Summary: Django is prone to insecure handling of HTTP requests. Vulnerability Insight: An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Vulnerability Impact: Successful exploitation may allow a man-in-the-middle attacker to read sensitive information. Affected Software/OS: Django versions 1.11.0 through 1.11.21, 2.1.0 through 2.1.9 and 2.2.0 through 2.2.2. Solution: Update to version 1.11.22, 2.1.10 or 2.2.3 respectively. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2019-12781
Copyright	Copyright (C) 2019 Greenbone Networks GmbH