Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before
    1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model
    attribute in ModelAdmin.readonly_fields, as demonstrated by a @property. (CVE-2015-2241)

Updated python-django packages fix security vulnerabilities :

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a \@property (CVE-2015-2241).

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string (CVE-2015-2316).

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL (CVE-2015-2317).

ID	Name	Product	Family	Severity
432982	SCA: security update for django (GHSA-6565-fg86-6jcx)	Tenable Cloud Security	SCA Checks	medium
432982	SCA: security update for django (GHSA-6565-fg86-6jcx)	Tenable Self-Hosted Container Security	SCA Checks	medium
82362	Mandriva Linux Security Advisory : python-django (MDVSA-2015:109)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2015-2241

medium

Tenable Plugins

medium

medium

medium