CVE-2019-12781

mediumPriorität · verfolgen · 22OT-Risiko · erhöhtEPSS 0.017 · 77. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.71% (77th) EPSS

CVSS 5 · medium

Is it mine?

32 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenpython-django-0:2.1.11-1.el8ost.src as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython-django-bash-completion-0:2.1.11-1.el8ost.noarch as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython3-django-0:2.1.11-1.el8ost.noarch as a component of Red Hat OpenStack Platform 15.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1324
Behobenpython-django-0:1.11.27-1.el7ost.src as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-0:1.11.27-1.el7ost.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-bash-completion-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython-django-bash-completion-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython2-django-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython2-django-0:1.11.27-1.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4390
Behobenpython312-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython312-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython312-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython312-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython313-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython313-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython313-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenpython313-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.04.8mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · Red Hat Product Security US

v3.04.9mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.06.5mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · SUSE Product Security

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-319USprimärCWE-20USCWE-319USCWE-358USCWE-444US

betroffene Produkte (32)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
Canonical Ltd. Ubuntu≤ 19.04fstec_bduRU
Canonical Ltd. Ubuntu≤ 16.04fstec_bduRU
Canonical Ltd. Ubuntu≤ 18.10fstec_bduRU
Canonical Ltd. Ubuntu≤ 18.04fstec_bduRU
Django Software Foundation Django1.11 → 1.11.22fstec_bduRU
Django Software Foundation Django2.1 → 2.1.10fstec_bduRU
Django Software Foundation Django2.2 → 2.2.3fstec_bduRU
АО «Концерн ВНИИНС» ОС ОН «Стрелец»≤ 16.01.2023fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.6 «Смоленск»fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition для «Эльбрус»≤ 8.1 «Ленинград»fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
canonical ubuntu linux= 16.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.10nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 19.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
debian debian linux= 9.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
djangoproject django1.11 → 1.11.22nvdUScpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
djangoproject django2.1 → 2.1.10nvdUScpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
djangoproject django2.2 → 2.2.3nvdUScpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

20 von 32 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2020:1324Red Hat Security Advisory: python-django security update2020-04-06csaf · redhat_csafUS
An update for python-django is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:4390Red Hat Security Advisory: python-django security update2020-10-28csaf · redhat_csafUS
An update for python-django is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
openSUSE-SU-2026:10005-1python312-Django6-6.0-1.1 on GA media2026-01-03csaf · suse_csafDE
python312-Django6-6.0-1.1 on GA media
GHSA-6c7v-2f49-8h26Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS2019-07-03ghsa · osvUS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
PYSEC-2019-102019-07-01vendor · osvUS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv nvd redhat_csaf suse_csaf NVD CVE.org MITRE

veröffentlicht 2019-07-01geändert 2026-06-17

verwandt (1,183)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-22948US	medium6.5OT kritisch	13.3% (96th)	KEV	2022-03-29
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may…
CVE-2018-12710US	high8.0OT hoch	76.5% (100th)	Exploit	2018-08-29
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inter…
CVE-2017-5259US	high8.8OT hoch	33.3% (98th)	Exploit	2017-12-20
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or…
CVE-2018-1297US	critical9.8OT hoch	11.5% (96th)	Exploit	2018-02-13
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauth…
CVE-2017-3737US	medium5.9OT hoch	78.7% (100th)	—	2017-12-07
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into th…

+1178 weitere

Referenzen (52)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan