CVE-2016-6186

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-6186
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6186.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-6186
Aliases
Downstream
Published
2016-08-05T15:59:09.503Z
Modified
2026-07-08T05:49:57.856808824Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.9.0-rc1"
                },
                {
                    "last_affected": "1.9.0-rc1"
                },
                {
                    "introduced": "1.10-alpha1"
                },
                {
                    "last_affected": "1.10-alpha1"
                },
                {
                    "introduced": "1.10-beta1"
                },
                {
                    "last_affected": "1.10-beta1"
                }
            ],
            "cpes": [
                "cpe:2.3:a:djangoproject:django:1.10:alpha1:*:*:*:*:*:*",
                "cpe:2.3:a:djangoproject:django:1.10:beta1:*:*:*:*:*:*",
                "cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "djangoproject:django"
        }
    ]
}
References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4022b2c306e88a4ab7f80507e736ce7ac7d01186
Introduced
3df8ccf6fc3fa0ab2acf9a03da43fea87f8ff392
Last affected
8a2a3a63b83375d9322c077b6356007e0bef5939
Fixed
d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
Fixed
f68e5a99164867ab0e071a936470958ed867479d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.13"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.9.1"
        },
        {
            "last_affected": "1.9.1"
        },
        {
            "introduced": "1.9.2"
        },
        {
            "last_affected": "1.9.2"
        },
        {
            "introduced": "1.9.3"
        },
        {
            "last_affected": "1.9.3"
        },
        {
            "introduced": "1.9.4"
        },
        {
            "last_affected": "1.9.4"
        },
        {
            "introduced": "1.9.5"
        },
        {
            "last_affected": "1.9.5"
        },
        {
            "introduced": "1.9.6"
        },
        {
            "last_affected": "1.9.6"
        },
        {
            "introduced": "1.9.7"
        },
        {
            "last_affected": "1.9.7"
        }
    ],
    "cpe": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0
1.1
1.2
1.2.1
1.3
1.4
1.7a2
1.8
1.8.1
1.8.10
1.8.11
1.8.12
1.8.13
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8a1
1.8b1
1.8b2
1.8c1
1.9
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9a1
1.9b1
1.9rc1
1.9rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6186.json"