CVE-2016-6186: debian debian_linux Cross-site Scripting

CVSS: 6.1v3.0MediumModified

AliasesMGASA-2016-0282GHSA-c8c8-9472-w52hPYSEC-2016-2+8 more

Published 05-08-2016Last modified 06-08-2024

Vulnerability summary

CVE-2016-6186 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 5.58% chance of exploitation in the next 30 days, higher than 92.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.0 (NVD)

EPSS score

5.58%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1exploit-database

Timeline

05-08-2016
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

CVSS metrics

7 scores · 5 sources · 3 versions

v4.05.3v3.06.1v2.04.3

EPSS trend

Probability

5.58%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

0.00 pp

From 5.58% on 20-09-2026

20-09-202620-10-2026

EPSS score

5.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasepythonVerified
Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat3 products

python-django< 0:1.8.14-1.el7ost
python-django-bash-completion< 0:1.8.14-1.el7ost
python-django-doc< 0:1.8.14-1.el7ost

Debian2 products

python-django< 1:1.9.8-1 | < 1.7.7-1+deb8u5 | < 1.4.5-1+deb7u17
debian_linuxEOL8.0

Djangoproject1 product

djangoEOL≤ 1.8.13 | 1.9 | 1.9.0:rc1 | 1.9.1 | 1.9.2 | 1.9.3 | 1.9.4 | 1.9.5 | 1.9.6 | 1.9.7 | 1.10:alpha1 | 1.10:beta1

Mageia1 product

python-django< 1.8.14-1.mga5

PyPI1 product

django< 1.8.14 | ≥ 1.9, < 1.9.8 | ≥ 1.10a1, < 1.10rc1 | < f68e5a99164867ab0e071a936470958ed867479d | ≥ 1.10a0, < 1.10rc1

Ubuntu1 product

python-django< 1.8.7-1ubuntu5.1

6 vendors · 9 products

References

47 links

www.securitytracker.com/id/1036338VDB EntryX Refsource SECTRACKWEB
seclists.org/fulldisclosure/2016/Jul/53Mailing ListX Refsource FULLDISCPatchWEB
rhn.redhat.com/errata/RHSA-2016-1594.htmlVendor AdvisoryX Refsource REDHATWEBAdvisory
www.debian.org/security/2016/dsa-3622Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEBAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.vulnerability-lab.com/get_content.php?id=1869X Refsource MISCPatchThird Party AdvisoryWEB
www.securityfocus.com/archive/1/538947/100/0/threadedMailing ListX Refsource BUGTRAQWEB
packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.htmlX Refsource MISCVDB EntryWEB
www.ubuntu.com/usn/USN-3039-1Vendor AdvisoryX Refsource UBUNTUThird Party AdvisoryWEBAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA

Show all 47 references

github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479dX Refsource CONFIRMPatchWEBFIX
rhn.redhat.com/errata/RHSA-2016-1596.htmlVendor AdvisoryX Refsource REDHATWEBAdvisory
www.djangoproject.com/weblog/2016/jul/18/security-releases/X Refsource CONFIRMPatchVendor AdvisoryWEBARTICLEREPORT
github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158X Refsource CONFIRMPatchWEBFIX
www.securityfocus.com/bid/92058VDB EntryX Refsource BIDWEB
rhn.redhat.com/errata/RHSA-2016-1595.htmlVendor AdvisoryX Refsource REDHATWEBAdvisory
www.exploit-db.com/exploits/40129/ExploitX Refsource EXPLOIT DBWEB
advisories.mageia.org/MGASA-2016-0282.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=18979REPORT
www.debian.org/security/2016/dsa-3622WEB
nvd.nist.gov/vuln/detail/CVE-2016-6186Advisory
github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1WEB
github.com/django/djangoPACKAGE
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yamlWEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
web.archive.org/web/20201022155237/http://www.securityfocus.com/archive/1/538947/100/0/threadedWEB
web.archive.org/web/20210123154652/http://www.securityfocus.com/bid/92058WEB
web.archive.org/web/20211204042848/http://www.securitytracker.com/id/1036338WEB
www.djangoproject.com/weblog/2016/jul/18/security-releasesWEB
www.exploit-db.com/exploits/40129WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
github.com/advisories/GHSA-c8c8-9472-w52hAdvisory
access.redhat.com/errata/RHSA-2016:1594Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1355663REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1594.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-6186REPORT
www.cve.org/CVERecord?id=CVE-2016-6186AdvisoryREPORT
access.redhat.com/errata/RHSA-2016:1595Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1595.jsonAdvisory
access.redhat.com/errata/RHSA-2016:1596Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1596.jsonAdvisory
ubuntu.com/security/CVE-2016-6186REPORT
ubuntu.com/security/notices/USN-3039-1Advisory
security-tracker.debian.org/tracker/CVE-2016-6186Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities