Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function…
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
Why it matters now
EPSS 0.05536 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Django (PyPI): 1.8.14, 1.9.8, 1.10rc1Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | before 1.8.14 | 1.8.14 | Patch available | GHSA-c8c8-9472-w52h |
| — | Django (PyPI) | 1.9 to before 1.9.8 | 1.9.8 | Patch available | GHSA-c8c8-9472-w52h |
| — | Django (PyPI) | 1.10a1 to before 1.10rc1 | 1.10rc1 | Patch available | GHSA-c8c8-9472-w52h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected before 1.8.14 Fixed in 1.8.14 Patch available GHSA-c8c8-9472-w52h
- Django (PyPI) Vendor— Affected 1.9 to before 1.9.8 Fixed in 1.9.8 Patch available GHSA-c8c8-9472-w52h
- Django (PyPI) Vendor— Affected 1.10a1 to before 1.10rc1 Fixed in 1.10rc1 Patch available GHSA-c8c8-9472-w52h
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | up to 1.8.13 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:* | 1.9.0 rc1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:* | 1.9.1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:* | 1.9.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:* | 1.9.3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:* | 1.9.4 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:* | 1.9.5 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:* | 1.9.6 | Vulnerable | djangoproject |
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions up to 1.8.13 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:* Versions 1.9.0 rc1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·djangoproject
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:* | 1.9.7 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.10:alpha1:*:*:*:*:*:* | 1.10 alpha1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.10:beta1:*:*:*:*:*:* | 1.10 beta1 | Vulnerable | djangoproject |
- cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.10:alpha1:*:*:*:*:*:* Versions 1.10 alpha1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.10:beta1:*:*:*:*:*:* Versions 1.10 beta1 Vulnerable ·djangoproject
Remediation
- Fix · GHSA-c8c8-9472-w52h Django (PyPI) Fixed in 1.8.14 Advisory →
- Fix · GHSA-c8c8-9472-w52h Django (PyPI) Fixed in 1.9.8 Advisory →
- Fix · GHSA-c8c8-9472-w52h Django (PyPI) Fixed in 1.10rc1 Advisory →
Red Hat 3 advisories
- RHSA-2016:1596 Released 2016-08-11 · Red Hat rating Moderatepython-django security update
- Red Hat OpenStack Platform 8.0 (Liberty) python-django-1.8.14-1.el7ost, python-django-bash-completion-1.8.14-1.el7ost
- RHSA-2016:1595 Released 2016-08-11 · Red Hat rating Moderatepython-django security update
- Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-django-1.8.14-1.el7ost, python-django-bash-completion-1.8.14-1.el7ost, python-django-doc-1.8.14-1.el7ost
- RHSA-2016:1594 Released 2016-08-10 · Red Hat rating Moderatepython-django security update
- Red Hat Enterprise Linux OpenStack Platform 8.0 Operational Tools for RHEL 7 python-django-1.8.14-1.el7ost, python-django-bash-completion-1.8.14-1.el7ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 1.3 | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | Fixed | RHSA-2016:1595 |
| Red Hat Enterprise Linux OpenStack Platform 8.0 Operational Tools for RHEL 7 | Fixed | RHSA-2016:1594 |
| Red Hat OpenStack Platform 8.0 (Liberty) | Fixed | RHSA-2016:1596 |
Not affected: 5 products
- Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
- Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
- Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 9 (Mitaka)
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6186
- 2026-10-03 Alias added: GHSA-c8c8-9472-w52h
References
Exploit 1
Patch 5
- 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186)
- http://www.vulnerability-lab.com/get_content.php?id=1869
- https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d
- https://www.djangoproject.com/weblog/2016/jul/18/security-releases/
- https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
Advisory 8
Other 11
- http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html
- https://github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW
- https://web.archive.org/web/20201022155237/http://www.securityfocus.com/archive/1/538947/100/0/threaded
- https://web.archive.org/web/20210123154652/http://www.securityfocus.com/bid/92058
- https://web.archive.org/web/20211204042848/http://www.securitytracker.com/id/1036338
- https://www.djangoproject.com/weblog/2016/jul/18/security-releases
- https://www.exploit-db.com/exploits/40129
Sources
- CVE-2016-6186 · CVE Program
- CVE-2016-6186 · NVD
- FIRST EPSS
- GHSA-c8c8-9472-w52h · GitHub Advisory Database · CC BY 4.0
- CVE-2016-6186 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences