CVE-2013-4249: Django cross-site scripting (XSS)… – CVSS 4.3 · Watchpost

← All vulnerabilities

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

MEDIUM 4.3CVE-2013-4249 · GHSA-4894-5vqc-6r2r · PYSEC-2013-19 · Published 04/10/2013 · updated 16/06/2026

In short

CVE-2013-4249 is a MEDIUM (CVSS 4.3) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.0% of all vulnerabilities.
Fix: update to 1.5.2 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.5, < 1.5.2`	`1.5.2`
django djangoproject	`= 1.5= 1.5.1= 1.6`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

NVD description

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

References

nvd.nist.gov/vuln/detail/CVE-2013-4249 · ADVISORY
django/django commit 90363e3 · WEB
django/django commit cbe6d55 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/86438 · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20201208180405/http://www.securitytracker.com/id/1028915 · WEB
djangoproject.com/weblog/2013/aug/13/security-releases-issued · WEB
seclists.org/oss-sec/2013/q3/369 · WEB
seclists.org/oss-sec/2013/q3/411 · WEB
secunia.com/advisories/54476 · Vendor Advisory
securitytracker.com/id/1028915

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free