NVD

Id
26396  
Name
CVE-2015-5144  
Description
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-07-14  
Modified Date
2016-12-23  
Seq
2015-5144  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
139507 26396 CVE-2015-5144 FEDORA-2015-1dd5bc998f  View
139508 26396 CVE-2015-5144 openSUSE-SU-2015:1802  View
139509 26396 CVE-2015-5144 openSUSE-SU-2015:1813  View
139510 26396 CVE-2015-5144 DSA-3305  View
139511 26396 CVE-2015-5144 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html  View
139512 26396 CVE-2015-5144 75665  View
139513 26396 CVE-2015-5144 USN-2671-1  View
139514 26396 CVE-2015-5144 GLSA-201510-06  View
139515 26396 CVE-2015-5144 https://www.djangoproject.com/weblog/2015/jul/08/security-releases/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
8317 JVNDB-2015-003637 Django における任意のヘッダを挿入される脆弱性 Django は、不正な正規表現を使用するため、任意のヘッダを挿入される、および HTTP レスポンス分割攻撃を実行される脆弱性が存在します。 CVE-2015-5144 82369 CVE-2015-5144 26396 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003637.html 2015-07-08 2015-10-30 View