CVE-2013-4249

EUVD-2013-0007
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Affected Products (NVD)
VendorProductVersion
djangoprojectdjango
1.5
djangoprojectdjango
1.5:alpha
djangoprojectdjango
1.5:beta
djangoprojectdjango
1.5.1
djangoprojectdjango
1.6:beta1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-django
bookworm
3:3.2.19-1+deb12u1
fixed
bookworm (security)
3:3.2.19-1+deb12u1
fixed
bullseye
2:2.2.28-1~deb11u2
fixed
bullseye (security)
2:2.2.28-1~deb11u2
fixed
sid
3:4.2.16-1
fixed
squeeze
not-affected
trixie
3:4.2.16-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-django
lucid
not-affected
precise
not-affected
quantal
not-affected
raring
not-affected
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2013/q3/369
http://seclists.org/oss-sec/2013/q3/411
http://secunia.com/advisories/54476
http://www.securitytracker.com/id/1028915
https://exchange.xforce.ibmcloud.com/vulnerabilities/86438
https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78
https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
http://seclists.org/oss-sec/2013/q3/369
http://seclists.org/oss-sec/2013/q3/411
http://secunia.com/advisories/54476
http://www.securitytracker.com/id/1028915
https://exchange.xforce.ibmcloud.com/vulnerabilities/86438
https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78
https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued