Cross-Site Scripting (XSS) Vulnerability in Django - CVE-2016-6186
Summary
CVE-2016-6186: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10r... Affects python-django across 3 version ranges.
< 1:1.9.8-1
< d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
< f68e5a99164867ab0e071a936470958ed867479d
Fixed in 1:1.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, authentication, and an admin interface. However, prior to version 1.9.8, Django had a vulnerability in the dismissChangeRelatedObjectPopup function that allowed attackers to exploit XSS vulnerabilities through unsafe usage of Element.innerHTML.
Vulnerability Detail
The vulnerability, identified as CVE-2016-6186, is a Cross-Site Scripting (XSS) issue that arises from the improper handling of user input in the dismissChangeRelatedObjectPopup function within Django's RelatedObjectLookups.js file. Attackers can inject arbitrary web scripts or HTML into web pages viewed by other users, potentially leading to data theft, session hijacking, or other malicious actions. This vulnerability affects versions of Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1.
How To Fix
Minimum fixed version
1:1.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to sanitize user input before it is processed by the dismissChangeRelatedObjectPopup function. This can be done by escaping HTML characters or using a library that provides XSS protection.
Conclusion
CVE-2016-6186 is a significant XSS vulnerability in Django that can lead to serious security risks if not addressed. Users are strongly advised to upgrade to the latest version of Django to protect their applications from potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
CVE-2016-6186 is a Cross-Site Scripting (XSS) vulnerability in Django that allows attackers to inject malicious scripts into web pages.
Django versions before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-6186 is 6.1, indicating a medium level of severity.
If an immediate upgrade is not possible, consider implementing input sanitization as a temporary workaround to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
