CVE-2011-4139

2011-10-1910:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2011-4139

django

url construction

vulnerability

cache poisoning

nvd

6.3 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.01 Low

EPSS

Percentile

83.1%

JSON

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request’s HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.

CPENameOperatorVersion
djangoproject:djangodjangoproject djangole1.2.6
djangoproject:djangodjangoproject djangoeq1.2.5
djangoproject:djangodjangoproject djangoeq0.95
djangoproject:djangodjangoproject djangoeq1.0
djangoproject:djangodjangoproject djangoeq1.3
djangoproject:djangodjangoproject djangoeq1.1.2
djangoproject:djangodjangoproject djangoeq1.0.1
djangoproject:djangodjangoproject djangoeq1.1
djangoproject:djangodjangoproject djangoeq1.2.1
djangoproject:djangodjangoproject djangoeq1.2.4

CPE	Name	Operator	Version
djangoproject:django	djangoproject django	le	1.2.6
djangoproject:django	djangoproject django	eq	1.2.5
djangoproject:django	djangoproject django	eq	0.95
djangoproject:django	djangoproject django	eq	1.0
djangoproject:django	djangoproject django	eq	1.3
djangoproject:django	djangoproject django	eq	1.1.2
djangoproject:django	djangoproject django	eq	1.0.1
djangoproject:django	djangoproject django	eq	1.1
djangoproject:django	djangoproject django	eq	1.2.1
djangoproject:django	djangoproject django	eq	1.2.4