CVE-2015-2241
Django Cross-site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
CVE-2015-2241- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
CVE-2015-2241- Updated
- 2026-11-02
EUVDEUVD-2015-0017 No score
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
EUVD-2015-0017- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6565-fg86-6jcx
Django Cross-site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by an @property.
- Record
GHSA-6565-fg86-6jcx- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6565-fg86-6jcx
Django Cross-site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by an @property.
- Record
GHSA-6565-fg86-6jcx- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
CVE-2015-2241- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2241 No score
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
DEBIAN-CVE-2015-2241- Updated
- 2026-11-02
OSVMGASA-2015-0127 No score
Updated python-django packages fix security vulnerabilities
Updated python-django and python-django14 packages fix security vulnerabilities:
The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS attacks (CVE-2015-2241).
Django relies on user input in some cases to redirect the user to an "on success" URL. The security checks for these redirects accepted URLs with leading control characters and so considered URLs like \x08javascript:... safe. This issue doesn't affect Django currently, however, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack as some browsers such as Google Chrome ignore control characters at the start of a URL in an anchor href (CVE-2015-2317).
Note that the CVE-2015-2241 issue does not affect python-django14 directly, but client code using it may be affected. Please see the March 9th upstream advisory for more information on this.
- Record
MGASA-2015-0127- Updated
- 2026-11-02
OSVPYSEC-2015-8 No score
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
- Record
PYSEC-2015-8- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
before 1.7.6 | 1.7.6 |
djangoPyPI |
1.8a1 up to 1.8b2 | 1.8b2 |
python-djangoDebian:12 |
before 1.7.6-1 | 1.7.6-1 |
python-djangoDebian:13 |
before 1.7.6-1 | 1.7.6-1 |
python-djangoDebian:14 |
before 1.7.6-1 | 1.7.6-1 |
djangoPyPI |
before 1.7.6, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 45 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.31.4.41.4.51.4.61.4.71.4.81.4.91.51.5.1 |
1.7.6 |
djangoPyPI |
1.8a1 up to 1.8b2, plus listed versions 1.8b1 |
1.8b2 |
python-djangoMageia:4 From an advisory covering 3 CVEs |
before 1.5.9-1.2.mga4 | 1.5.9-1.2.mga4 |
python-django14Mageia:4 From an advisory covering 3 CVEs |
before 1.4.20-1.mga4 | 1.4.20-1.mga4 |
djangoPyPI |
before 1.7.6, 1.8a1 up to 1.8b2, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 45 moreShow less1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.31.4.41.4.51.4.61.4.71.4.81.4.91.51.5.1 |
1.7.61.8b2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2241 is a medium vulnerability (CVSS 4.3) in Djangoproject Django, published March 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. Fixed in django 1.7.6.
References
securityfocus.com/bid/73095
code.djangoproject.com/ticket/24461
djangoproject.com/weblog/2015/mar/09/security-releases
mandriva.com/security/advisories?name=MDVSA-2015:109
nvd.nist.gov/vuln/detail/CVE-2015-2241
github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5
Show 10 moreShow less
web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109?name=MDVSA-2015:109
security-tracker.debian.org/tracker/CVE-2015-2241
advisories.mageia.org/MGASA-2015-0127.html
bugs.mageia.org/show_bug.cgi?id=15528
Left out here: 59 versions. The JSON record has them.