CVE-2015-2241
MEDIUM6.1EPSS 0.26%Django Cross-site Scripting Vulnerability
發布日:2022/5/17修改日:2025/2/19
描述
Cross-site scripting (XSS) vulnerability in the contents function in `admin/helpers.py` in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in `ModelAdmin.readonly_fields`, as demonstrated by an `@property`.
受影響套件(3)
- Debian/python-djangofrom 0, < 1.7.6-1
- PyPI/djangofrom 0, < 1.7.6
- PyPI/djangofrom 0, < 1.7.6, >= 1.8a1, < 1.8b2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
參考連結(13)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2015-2241
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-2241
- ADVISORYhttps://www.djangoproject.com/weblog/2015/mar/09/security-releases/
- PATCHhttps://github.com/django/django
- WEBhttps://code.djangoproject.com/ticket/24461
- WEBhttps://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5
- WEBhttps://github.com/django/django/commit/82c9169077a066995e3b00aac551bf1c8a89d98a
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-8.yaml
- WEBhttps://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109
- WEBhttps://web.archive.org/web/20171112005349/http://www.securityfocus.com/bid/73095
- WEBhttps://www.djangoproject.com/weblog/2015/mar/09/security-releases
- WEBhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:109
- WEBhttp://www.securityfocus.com/bid/73095