{"id":"CVE-2015-2241","aliases":["DEBIAN-CVE-2015-2241","EUVD-2015-0017","GHSA-6565-fg86-6jcx","MGASA-2015-0127","PYSEC-2015-8"],"status":"published","title":"Django Cross-site Scripting Vulnerability","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02061,"percentile":0.81467,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-03-12T14:00:00Z","modified":"2026-09-09T06:47:18Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.7.6","1.8b2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.7.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.7.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.7.6-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8b2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8b2"}]}],"versions":["1.8a1","1.8b1"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"},{"introduced":"1.8a1"},{"fixed":"1.8b2"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8a1","1.8b1"]}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://www.securityfocus.com/bid/73095","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://code.djangoproject.com/ticket/24461","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","evidence","web"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/09/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:109","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2241","tags":["advisory"]},{"url":"https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5","tags":["web"]},{"url":"https://github.com/django/django/commit/82c9169077a066995e3b00aac551bf1c8a89d98a","tags":["web"]},{"url":"https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109","tags":["web"]},{"url":"https://web.archive.org/web/20171112005349/http://www.securityfocus.com/bid/73095","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-8.yaml","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/09/security-releases","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6565-fg86-6jcx","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2241","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15528","tags":["report"]},{"url":"https://www.djangoproject.com/weblog/2015/mar/18/security-releases/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2241","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:00:00Z","modified":"2024-08-06T05:10:15.804Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-0017","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:00:00Z","modified":"2024-08-06T05:10:15Z","updated_at":"2026-11-03T02:22:12.830256Z"}],"ghsa":[{"id":"GHSA-6565-fg86-6jcx","title":"Django Cross-site Scripting Vulnerability","description":"Cross-site scripting (XSS) vulnerability in the contents function in `admin/helpers.py` in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in `ModelAdmin.readonly_fields`, as demonstrated by an `@property`.","status":"published","published":"2022-05-17T03:34:12Z","modified":"2024-09-18T14:38:33Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2015-2241","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:59:05.87Z","modified":"2026-06-17T00:23:48.18Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"GHSA-6565-fg86-6jcx","title":"Django Cross-site Scripting Vulnerability","description":"Cross-site scripting (XSS) vulnerability in the contents function in `admin/helpers.py` in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in `ModelAdmin.readonly_fields`, as demonstrated by an `@property`.","status":"published","published":"2022-05-17T03:34:12Z","modified":"2025-02-19T05:36:45.717425Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"CVE-2015-2241","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:59:05Z","modified":"2026-04-16T06:24:20.836211615Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2241","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:59:05.87Z","modified":"2026-09-09T06:47:18.35501967Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0127","title":"Updated python-django packages fix security vulnerabilities","description":"Updated python-django and python-django14 packages fix security\nvulnerabilities:\n\nThe ModelAdmin.readonly_fields attribute in the Django admin allows\ndisplaying model fields and model attributes. While the former were correctly\nescaped, the latter were not. Thus untrusted content could be injected into\nthe admin, presenting an exploitation vector for XSS attacks (CVE-2015-2241).\n\nDjango relies on user input in some cases to redirect the user to an \"on\nsuccess\" URL. The security checks for these redirects accepted URLs with\nleading control characters and so considered URLs like \\x08javascript:...\nsafe. This issue doesn't affect Django currently, however, if a developer\nrelies on is_safe_url() to provide safe redirect targets and puts such a URL\ninto a link, they could suffer from an XSS attack as some browsers such as\nGoogle Chrome ignore control characters at the start of a URL in an anchor\nhref (CVE-2015-2317).\n\nNote that the CVE-2015-2241 issue does not affect python-django14 directly,\nbut client code using it may be affected.  Please see the March 9th upstream\nadvisory for more information on this.\n","status":"published","published":"2015-04-03T13:11:23Z","modified":"2026-04-16T06:24:06.141571818Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PYSEC-2015-8","description":"Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.","status":"published","published":"2015-03-12T14:59:00Z","modified":"2026-06-10T17:00:59.936539196Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}