CVE-2016-6186

Description

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

13.095

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2016-6186 are fixed in Python-django 1.10rc1	Windows
Vulnerabilities CVE-2016-6186 are fixed in Python-django 1.8.14	Windows
Vulnerabilities CVE-2016-6186 are fixed in Python-django 1.9.8	Windows
High-level Python web development framework (USN-3039-1) python-django_1.8.7-1ubuntu5.1_all.deb	Linux
High-level Python web development framework (USN-3039-1) python3-django_1.8.7-1ubuntu5.1_all.deb	Linux
Vulnerabilities CVE-2016-6186 are fixed in Python-django for linux 1.10rc1	Linux
Vulnerabilities CVE-2016-6186 are fixed in Python-django for linux 1.8.14	Linux
Vulnerabilities CVE-2016-6186 are fixed in Python-django for linux 1.9.8	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234