CVE-2016-6186 Django Cross-site scripting Vulnerability
MediumCVSS 6.1
EPSS 5.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.8.14 | 1.8.14 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3.2 | No fix listed |
| pypi django(PyPI) | = 1.3.3 | No fix listed |
| pypi django(PyPI) | = 1.3.4 | No fix listed |
| pypi django(PyPI) | = 1.3.5 | No fix listed |
| pypi django(PyPI) | = 1.3.6 | No fix listed |
Show 114 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.3.7 | No fix listed |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.14 | No fix listed |
| pypi django(PyPI) | = 1.4.15 | No fix listed |
| pypi django(PyPI) | = 1.4.16 | No fix listed |
| pypi django(PyPI) | = 1.4.17 | No fix listed |
| pypi django(PyPI) | = 1.4.18 | No fix listed |
| pypi django(PyPI) | = 1.4.19 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.20 | No fix listed |
| pypi django(PyPI) | = 1.4.21 | No fix listed |
| pypi django(PyPI) | = 1.4.22 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| pypi django(PyPI) | = 1.5 | No fix listed |
| pypi django(PyPI) | = 1.5.1 | No fix listed |
| pypi django(PyPI) | = 1.5.10 | No fix listed |
| pypi django(PyPI) | = 1.5.11 | No fix listed |
| pypi django(PyPI) | = 1.5.12 | No fix listed |
| pypi django(PyPI) | = 1.5.2 | No fix listed |
| pypi django(PyPI) | = 1.5.3 | No fix listed |
| pypi django(PyPI) | = 1.5.4 | No fix listed |
| pypi django(PyPI) | = 1.5.5 | No fix listed |
| pypi django(PyPI) | = 1.5.6 | No fix listed |
| pypi django(PyPI) | = 1.5.7 | No fix listed |
| pypi django(PyPI) | = 1.5.8 | No fix listed |
| pypi django(PyPI) | = 1.5.9 | No fix listed |
| pypi django(PyPI) | = 1.6 | No fix listed |
| pypi django(PyPI) | = 1.6.1 | No fix listed |
| pypi django(PyPI) | = 1.6.10 | No fix listed |
| pypi django(PyPI) | = 1.6.11 | No fix listed |
| pypi django(PyPI) | = 1.6.2 | No fix listed |
| pypi django(PyPI) | = 1.6.3 | No fix listed |
| pypi django(PyPI) | = 1.6.4 | No fix listed |
| pypi django(PyPI) | = 1.6.5 | No fix listed |
| pypi django(PyPI) | = 1.6.6 | No fix listed |
| pypi django(PyPI) | = 1.6.7 | No fix listed |
| pypi django(PyPI) | = 1.6.8 | No fix listed |
| pypi django(PyPI) | = 1.6.9 | No fix listed |
| pypi django(PyPI) | = 1.7 | No fix listed |
| pypi django(PyPI) | = 1.7.1 | No fix listed |
| pypi django(PyPI) | = 1.7.10 | No fix listed |
| pypi django(PyPI) | = 1.7.11 | No fix listed |
| pypi django(PyPI) | = 1.7.2 | No fix listed |
| pypi django(PyPI) | = 1.7.3 | No fix listed |
| pypi django(PyPI) | = 1.7.4 | No fix listed |
| pypi django(PyPI) | = 1.7.5 | No fix listed |
| pypi django(PyPI) | = 1.7.6 | No fix listed |
| pypi django(PyPI) | = 1.7.7 | No fix listed |
| pypi django(PyPI) | = 1.7.8 | No fix listed |
| pypi django(PyPI) | = 1.7.9 | No fix listed |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| pypi django(PyPI) | = 1.8a1 | No fix listed |
| pypi django(PyPI) | = 1.8b1 | No fix listed |
| pypi django(PyPI) | = 1.8b2 | No fix listed |
| pypi django(PyPI) | = 1.8c1 | No fix listed |
| pypi django(PyPI) | >= 1.9, < 1.9.8 | 1.9.8 |
| pypi django(PyPI) | = 1.9 | No fix listed |
| pypi django(PyPI) | = 1.9.1 | No fix listed |
| pypi django(PyPI) | = 1.9.2 | No fix listed |
| pypi django(PyPI) | = 1.9.3 | No fix listed |
| pypi django(PyPI) | = 1.9.4 | No fix listed |
| pypi django(PyPI) | = 1.9.5 | No fix listed |
| pypi django(PyPI) | = 1.9.6 | No fix listed |
| pypi django(PyPI) | = 1.9.7 | No fix listed |
| pypi django(PyPI) | >= 1.10a1, < 1.10rc1 | 1.10rc1 |
| pypi django(PyPI) | = 1.10a1 | No fix listed |
| pypi django(PyPI) | = 1.10b1 | No fix listed |
| pypi django(PyPI) | >= 1.10a0, < 1.10rc1 | 1.10rc1 |
| pypi django(PyPI) | = 1.9rc2 | No fix listed |
| pypi django(PyPI) | = 1.9rc1 | No fix listed |
| pypi django(PyPI) | = 1.9b1 | No fix listed |
| pypi django(PyPI) | = 1.9a1 | No fix listed |
| pypi django(PyPI) | = 1.7a2 | No fix listed |
| pypi django(PyPI) | = 1.0 | No fix listed |
| debian/python-django(Debian:12) | < 1:1.9.8-1 | 1:1.9.8-1 |
| debian/python-django(Debian:13) | < 1:1.9.8-1 | 1:1.9.8-1 |
| debian/python-django(Debian:14) | < 1:1.9.8-1 | 1:1.9.8-1 |
| debian linux | = 8.0 | No fix listed |
| djangoproject django | <= 1.8.13 | No fix listed |
| djangoproject django | = 1.9 | No fix listed |
| djangoproject django | = 1.9.0-rc1 | No fix listed |
| djangoproject django | = 1.9.1 | No fix listed |
| djangoproject django | = 1.9.2 | No fix listed |
| djangoproject django | = 1.9.3 | No fix listed |
| djangoproject django | = 1.9.4 | No fix listed |
| djangoproject django | = 1.9.5 | No fix listed |
| djangoproject django | = 1.9.6 | No fix listed |
| djangoproject django | = 1.9.7 | No fix listed |
| djangoproject django | = 1.10-alpha1 | No fix listed |
| djangoproject django | = 1.10-beta1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- web.archive.org
- web.archive.org
- web.archive.org
- www.djangoproject.com patch technical-description vendor-advisory
- 40129 exploit
- packetstormsecurity.com exploit vdb-entry
- RHSA-2016:1594 vendor-advisory
- RHSA-2016:1595 vendor-advisory
- RHSA-2016:1596 vendor-advisory
- 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186) mailing-list patch
- DSA-3622 third-party-advisory vendor-advisory
- USN-3039-1 third-party-advisory vendor-advisory
- www.vulnerability-lab.com patch third-party-advisory
- 1036338 vdb-entry
- 92058 vdb-entry
- 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186) mailing-list
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-6186 vendor-advisory
- FEDORA-2016-b7e31a0b9a vendor-advisory
- FEDORA-2016-97ca9d52a4 vendor-advisory
- bugs.debian.org issue-tracking