Cross-site scripting in Django in Django - CVE-2016-6186

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU165

Cross-site scripting in Django in Django - CVE-2016-6186

Published: July 19, 2016 / Updated: September 14, 2018


Vulnerability identifier: #VU165
CSH Severity: High
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2016-6186
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to improper filtering HTML code from user-supplied input. A remote user can cause arbitrary scripting code execution by the target administrative user's browser. The code will originate from the site running the Django software. As a result, the code will be able to access the target user's cookies, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

Django
Arch Linux
Debian Linux
Fedora
Ubuntu
py-django (Alpine package)
python-django16
python-django
Red Hat OpenStack

How to mitigate CVE-2016-6186

The vendor has issued a fix (1.9.8, and 1.8.14, 1.9.8).

py-django (Alpine package) - update to 1.7.9-r2
python-django16 - update to 1.6.11.7-5.el7
python-django - addressed in versions 1.8.14-1.fc23, 1.9.8-1.fc24, 1.11.13-2.el7, 1.11.13-4.el7

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins