PT-2016-6791 · Django Software Foundation+2 · Django+2

Benjamin Kunz Mejri · Publicado 2016-07-18 · Atualizado 2022-05-14 · CVE-2016-6186

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Django versions 1.8.0 through 1.8.13 Django versions 1.9.0 through 1.9.7 Django versions 1.10.0 through 1.10.0rc1

Description A cross-site scripting (XSS) issue exists in the dismissChangeRelatedObjectPopup function, allowing remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. This can be exploited by injecting malicious code into the webpage.

Recommendations For Django versions 1.8.0 through 1.8.13, update to version 1.8.14 or later. For Django versions 1.9.0 through 1.9.7, update to version 1.9.8 or later. For Django versions 1.10.0 through 1.10.0rc1, update to version 1.10rc1 or later. As a temporary workaround, consider disabling the dismissChangeRelatedObjectPopup function until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2016-2173

CVE-2016-6186

DLA-555-1

DSA-3622-1

GHSA-C8C8-9472-W52H

MGASA-2016-0282

PYSEC-2016-2

RHSA-2016:1594

RHSA-2016:1595

RHSA-2016:1596

USN-3039-1

Produtos afetados

Alt Linux

Django

Ubuntu

Referências · 41

• 🔥 https://exploit-db.com/exploits/40129 · Exploit
• https://github.com/django/django · Nota
• https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158 · Correção
• https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d · Correção
• https://github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yaml · Nota
• http://rhn.redhat.com/errata/RHSA-2016-1594.html · Aviso do Fabricante
• https://web.archive.org/web/20211204042848/http://securitytracker.com/id/1036338 · Nota
• https://ubuntu.com/security/notices/USN-3039-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6186 · Nota de Segurança
• https://debian.org/security/2016/dsa-3622 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ · Aviso do Fabricante
• http://vulnerability-lab.com/get_content.php?id=1869 · Correção
• http://debian.org/security/2016/dsa-3622 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2016/Jul/53 · Correção