Description
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.5.2-1 | — |
| Debian 13 | python-django | 1.5.2-1 | — |
| Debian 12 | python-django | 1.5.2-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 1.5, < 1.5.2 | 1.5.2 | GHSA-4894-5vqc-6r2r |
References
- 1028915 vdb-entry
- 54476 third-party-advisory
- [oss-security] 20130814 [CVE request] Django 1.4.6 security release mailing-list
- https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78
- django-administrative-xss(86438) vdb-entry
- https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
- https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560
- [oss-security] 20130819 Re: [CVE request] Django 1.4.6 security release mailing-list