-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django | pip | < 1.2.7 | 1.2.7 |
| Django | pip | >= 1.3, < 1.3.1 | 1.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description and patch information show that the core issue was improper handling of X-Forwarded-Host headers in host determination. The commit diff modifies HttpRequest.get_host() to add a check for settings.USE_X_FORWARDED_HOST before trusting HTTP_X_FORWARDED_HOST. This directly corresponds to CWE-20 (input validation failure) and CWE-349 (trusting extraneous headers). The pre-patch code path unconditionally used HTTP_X_FORWARDED_HOST if present, making this function the clear vulnerable entry point.
Ongoing coverage of React2Shell