Every CVE Search/ Get API key

CVE-2013-4249

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Exploit likelihood

2.89%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
CVE-2013-4249
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
CVE-2013-4249
Updated
2026-11-02
EUVDEUVD-2013-0007 No score

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
EUVD-2013-0007
Updated
2026-11-03
GitHub AdvisoriesGHSA-4894-5vqc-6r2r 5.3

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
GHSA-4894-5vqc-6r2r
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-4894-5vqc-6r2r 5.3

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
GHSA-4894-5vqc-6r2r
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
CVE-2013-4249
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4249 No score

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
DEBIAN-CVE-2013-4249
Updated
2026-11-02
OSVMGASA-2013-0256 No score

Updated python-django packages fix CVE-2013-4249

Updated python-django package fixes security vulnerability:

The is_safe_url() function has been modified to properly recognize and reject URLs which specify a scheme other than HTTP or HTTPS, to prevent cross-site scripting attacks through redirecting to other schemes, such as javascript. (CVE-2013-4249).

Record
MGASA-2013-0256
Updated
2026-11-02
OSVPYSEC-2013-19 No score

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Record
PYSEC-2013-19
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 1.5 up to 1.5.2
1.5.2
python-django
Debian:12
 before 1.5.2-1
1.5.2-1
python-django
Debian:13
 before 1.5.2-1
1.5.2-1
python-django
Debian:14
 before 1.5.2-1
1.5.2-1
django
PyPI
 1.5 up to 1.5.2, plus listed versions
1.5.1
1.5.2
python-django
Mageia:2
 before 1.3.7-1.1.mga2
1.3.7-1.1.mga2
python-django
Mageia:3
 before 1.4.6-1.mga3
1.4.6-1.mga3
django
PyPI
 1.5 up to 1.5.2, plus listed versions
1.5.11.5c21.5c11.5b21.5b1
Show 7 moreShow less
1.5a11.41.31.2.11.21.11.0
1.5.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4249 is a medium vulnerability (CVSS 4.3) in Djangoproject Django, published August 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 87th percentile. Fixed in django 1.5.2.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open