CVE-2015-2241

Django < 1.7.6 and 1.8 < 1.8b2 - Cross-Site Scripting via ModelAdmin.readonly_fields

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/73095
Exploit, Vendor Advisory x_refsource_confirm
https://code.djangoproject.com/ticket/24461
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:109

Scores

EPSS 0.0205
EPSS Percentile 79.2%

Details

CWE
CWE-79
Status published
Products (3)
djangoproject/django 1.8 beta1
djangoproject/django < 1.7.5
pypi/Django 0 - 1.7.6PyPI
Published Mar 12, 2015
Tracked Since Feb 18, 2026