Description

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.

Remediation

References

CVE-2015-2241

Related Vulnerabilities

MySQL CVE-2021-2300 Vulnerability (CVE-2021-2300)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3665)

Oracle Database Server CVE-2006-1876 Vulnerability (CVE-2006-1876)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-3063)

Drupal Other Vulnerability (CVE-2016-3166)

Severity

Medium

Classification

CVE-2015-2241 CWE-707

Tags

Missing Update Known Vulnerabilities