Description
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-1487 Vulnerability (CVE-2013-1487)
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20405)
WordPress Plugin Process Steps Template Designer Cross-Site Request Forgery (1.2.1)
WordPress Plugin JW Player for Flash & HTML5 Video Cross-Site Request Forgery (2.1.3)
Oracle Database Server CVE-2009-1964 Vulnerability (CVE-2009-1964)