CVE-2015-2241

Опубликовано: 12 мар. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.

Ссылки

http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
http://www.securityfocus.com/bid/73095
https://code.djangoproject.com/ticket/24461
Exploit
Vendor Advisory
https://www.djangoproject.com/weblog/2015/mar/09/security-releases/
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
http://www.securityfocus.com/bid/73095
https://code.djangoproject.com/ticket/24461
Exploit
Vendor Advisory
https://www.djangoproject.com/weblog/2015/mar/09/security-releases/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Версия до 1.7.5 (включая)

cpe:2.3:a:djangoproject:django:1.8:beta1:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.02061

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2015-2241

ubuntu

больше 11 лет назад

CVE-2015-2241

redhat

больше 11 лет назад

CVE-2015-2241

debian

больше 11 лет назад

Cross-site scripting (XSS) vulnerability in the contents function in a ...

GHSA-6565-fg86-6jcx

CVSS3: 6.1

github

больше 4 лет назад

Django Cross-site Scripting Vulnerability

ALT-PU-2015-2866

altlinux

больше 11 лет назад

ALT-PU-2015-2866: package `python-module-django` update to version 1.8-alt1.b1

EPSS

Процентиль: 81%

0.02061

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79