XSS in Djangoproject Django
CVE-2015-2241
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.021 (79.3th percentile) — read the EPSS interpretation.
Affected products
- Djangoproject Django — versions 1.8
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)