CVE-2015-2241: XSS
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonlyfields, as demonstrated by an @property.
Other sources
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonlyfields, as demonstrated by a @property.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2241?
CVE-2015-2241 is classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2015-2241?
To fix CVE-2015-2241, upgrade Django to version 1.7.6 or 1.8b2 or later.
What types of applications are affected by CVE-2015-2241?
CVE-2015-2241 affects Django applications that utilize the ModelAdmin.readonly_fields feature.
Can CVE-2015-2241 allow attackers to execute scripts?
Yes, CVE-2015-2241 allows remote attackers to inject arbitrary web scripts or HTML into affected applications.
Which versions of Django are vulnerable to CVE-2015-2241?
Versions of Django prior to 1.7.6 and 1.8 before 1.8b2 are vulnerable to CVE-2015-2241.