Main
Vulnerability Database
Exploits
ID:368 - Exploit for Cross-site scripting in Django in Django - CVE-2016-6186
ID:368 - Exploit for Cross-site scripting in Django in Django - CVE-2016-6186
Published: March 18, 2020
Vulnerability identifier: #VU165
Vulnerability risk: High
CVE-ID: CVE-2016-6186
CWE-ID: CWE-79
Exploitation vector: Remote access
Vulnerable software:
Django
Django
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to improper filtering HTML code from user-supplied input. A remote user can cause arbitrary scripting code execution by the target administrative user's browser. The code will originate from the site running the Django software. As a result, the code will be able to access the target user's cookies, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
The vulnerability exists due to improper filtering HTML code from user-supplied input. A remote user can cause arbitrary scripting code execution by the target administrative user's browser. The code will originate from the site running the Django software. As a result, the code will be able to access the target user's cookies, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
The vendor has issued a fix (1.9.8, and 1.8.14, 1.9.8).