id: PYSEC-2016-2
details: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup
  function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django
  before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers
  to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
affected:
- package:
    name: django
    ecosystem: PyPI
    purl: pkg:pypi/django
  ranges:
  - type: GIT
    repo: https://github.com/django/django
    events:
    - introduced: "0"
    - fixed: d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
    - fixed: f68e5a99164867ab0e071a936470958ed867479d
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.8.14
    - introduced: "1.9"
    - fixed: 1.9.8
    - introduced: 1.10a0
    - fixed: 1.10rc1
  versions:
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - "1.1"
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - "1.2"
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - "1.3"
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - "1.4"
  - 1.4.1
  - 1.4.10
  - 1.4.11
  - 1.4.12
  - 1.4.13
  - 1.4.14
  - 1.4.15
  - 1.4.16
  - 1.4.17
  - 1.4.18
  - 1.4.19
  - 1.4.2
  - 1.4.20
  - 1.4.21
  - 1.4.22
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - "1.5"
  - 1.5.1
  - 1.5.10
  - 1.5.11
  - 1.5.12
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - 1.5.8
  - 1.5.9
  - "1.6"
  - 1.6.1
  - 1.6.10
  - 1.6.11
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - "1.7"
  - 1.7.1
  - 1.7.10
  - 1.7.11
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 1.7.9
  - "1.8"
  - 1.8.1
  - 1.8.10
  - 1.8.11
  - 1.8.12
  - 1.8.13
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.8.6
  - 1.8.7
  - 1.8.8
  - 1.8.9
  - 1.8a1
  - 1.8b1
  - 1.8b2
  - 1.8c1
  - "1.9"
  - 1.9.1
  - 1.9.2
  - 1.9.3
  - 1.9.4
  - 1.9.5
  - 1.9.6
  - 1.9.7
  - 1.10a1
  - 1.10b1
references:
- type: WEB
  url: http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html
- type: WEB
  url: http://www.vulnerability-lab.com/get_content.php?id=1869
- type: WEB
  url: http://www.securitytracker.com/id/1036338
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-3039-1
- type: ADVISORY
  url: http://www.debian.org/security/2016/dsa-3622
- type: FIX
  url: https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
- type: FIX
  url: https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d
- type: ARTICLE
  url: https://www.djangoproject.com/weblog/2016/jul/18/security-releases/
- type: WEB
  url: http://seclists.org/fulldisclosure/2016/Jul/53
- type: WEB
  url: http://www.securityfocus.com/bid/92058
- type: ADVISORY
  url: http://rhn.redhat.com/errata/RHSA-2016-1596.html
- type: ADVISORY
  url: http://rhn.redhat.com/errata/RHSA-2016-1595.html
- type: WEB
  url: https://www.exploit-db.com/exploits/40129/
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ/
- type: ADVISORY
  url: http://rhn.redhat.com/errata/RHSA-2016-1594.html
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW/
- type: WEB
  url: http://www.securityfocus.com/archive/1/538947/100/0/threaded
- type: ADVISORY
  url: https://github.com/advisories/GHSA-c8c8-9472-w52h
aliases:
- CVE-2016-6186
- GHSA-c8c8-9472-w52h
modified: "2021-09-01T08:35:44.164135Z"
published: "2016-08-05T15:59:00Z"