PT-2016-6791 · Django Software Foundation+2 · Django+2

Benjamin Kunz Mejri · Published 2016-07-18 · Updated 2022-05-14 · CVE-2016-6186

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Django versions 1.8.0 through 1.8.13 Django versions 1.9.0 through 1.9.7 Django versions 1.10.0 through 1.10.0rc1

Description A cross-site scripting (XSS) issue exists in the dismissChangeRelatedObjectPopup function, allowing remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. This can be exploited by injecting malicious code into the webpage.

Recommendations For Django versions 1.8.0 through 1.8.13, update to version 1.8.14 or later. For Django versions 1.9.0 through 1.9.7, update to version 1.9.8 or later. For Django versions 1.10.0 through 1.10.0rc1, update to version 1.10rc1 or later. As a temporary workaround, consider disabling the dismissChangeRelatedObjectPopup function until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-2173

CVE-2016-6186

DLA-555-1

DSA-3622-1

GHSA-C8C8-9472-W52H

MGASA-2016-0282

PYSEC-2016-2

RHSA-2016:1594

RHSA-2016:1595

RHSA-2016:1596

USN-3039-1

Affected Products

Alt Linux

Django

Ubuntu

References · 41

• 🔥 https://exploit-db.com/exploits/40129 · Exploit
• https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158 · Patch
• https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d · Patch
• http://rhn.redhat.com/errata/RHSA-2016-1594.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3039-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6186 · Security Note
• https://debian.org/security/2016/dsa-3622 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ · Vendor Advisory
• http://vulnerability-lab.com/get_content.php?id=1869 · Patch
• http://debian.org/security/2016/dsa-3622 · Vendor Advisory
• http://seclists.org/fulldisclosure/2016/Jul/53 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6186 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1595.html · Vendor Advisory