CVE-2016-6186 Django Cross-site scripting Vulnerability
Remote attackers can inject arbitrary web script or HTML into Django admin interfaces via unsafe innerHTML usage in the dismissChangeRelatedObjectPopup function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-6186?
CVE-2016-6186 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 5 Aug 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
Weakness: CWE-79
Which versions are affected by CVE-2016-6186?
7 open source packages ship an affected version, including django and Django. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | All versions | 1.8.14, 1.9.8, 1.10rc1 |
django PyPI | All versions | 1.8.14 |
django PyPI | From 1.10a1 | 1.10rc1 |
django PyPI | From 1.9 | 1.9.8 |
Django PyPI | All versions | 1.8.14 |
Django PyPI | From 1.10a1 | 1.10rc1 |
1 more packages
Django PyPI | From 1.9 | 1.9.8 |
Linux distribution packages (7)
python-django Red Hat:openstack-optools:8::el7 | All versions | 0:1.8.14-1.el7ost |
python-django-bash-completion Red Hat:openstack-optools:8::el7 | All versions | 0:1.8.14-1.el7ost |
python-django Red Hat:openstack:7::el7 | All versions | 0:1.8.14-1.el7ost |
python-django-bash-completion Red Hat:openstack:7::el7 | All versions | 0:1.8.14-1.el7ost |
python-django-doc Red Hat:openstack:7::el7 | All versions | 0:1.8.14-1.el7ost |
python-django Red Hat:openstack:8::el7 | All versions | 0:1.8.14-1.el7ost |
python-django-bash-completion Red Hat:openstack:8::el7 | All versions | 0:1.8.14-1.el7ost |
Products include Debian Debian Linux, Djangoproject Django.
How do I fix CVE-2016-6186?
Upgrade django to a fixed version for your release line: 1.8.14, 1.9.8 or 1.10rc1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2016-6186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-6186 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-6186, DLA-555-1, DSA-3622-1, GHSA-c8c8-9472-w52h, MGASA-2016-0282, PYSEC-2016-2 and 5 more.