CVE-2013-4249: Django cross-site scripting (XSS)… – CVSS 4.3 · Watchpost

← All vulnerabilities

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

MITTEL 4.3CVE-2013-4249 · GHSA-4894-5vqc-6r2r · PYSEC-2013-19 · Published 04/10/2013 · updated 16/06/2026

Kurz gesagt

CVE-2013-4249 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in django, django (djangoproject).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.9%, höher als bei 87.0% aller Schwachstellen.
Abhilfe: auf 1.5.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.5, < 1.5.2`	`1.5.2`
django djangoproject	`= 1.5= 1.5.1= 1.6`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

NVD description

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

References

nvd.nist.gov/vuln/detail/CVE-2013-4249 · ADVISORY
django/django commit 90363e3 · WEB
django/django commit cbe6d55 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/86438 · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20201208180405/http://www.securitytracker.com/id/1028915 · WEB
djangoproject.com/weblog/2013/aug/13/security-releases-issued · WEB
seclists.org/oss-sec/2013/q3/369 · WEB
seclists.org/oss-sec/2013/q3/411 · WEB
secunia.com/advisories/54476 · Vendor Advisory
securitytracker.com/id/1028915

Weitere Schwachstellen in django

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free