—

PYSEC-2013-19

Quick fix

PYSEC-2013-19 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=90363e388c61874add3f3557ee654a996ec75d78'

Details

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 0Fixed in: 90363e388c61874add3f3557ee654a996ec75d78

Fixpip install --upgrade 'django>=90363e388c61874add3f3557ee654a996ec75d78'

References

https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78[FIX]
http://www.securitytracker.com/id/1028915[WEB]
http://seclists.org/oss-sec/2013/q3/369[WEB]
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued[ARTICLE]
http://seclists.org/oss-sec/2013/q3/411[WEB]
https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560[FIX]
http://secunia.com/advisories/54476[ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/86438[WEB]
https://github.com/advisories/GHSA-4894-5vqc-6r2r[ADVISORY]