CVE-2016-6186

Name of the Vulnerable Software and Affected Versions Django versions 1.8.0 through 1.8.13 Django versions 1.9.0 through 1.9.7 Django versions 1.10.0 through 1.10.0rc1

Description A cross-site scripting (XSS) issue exists in the dismissChangeRelatedObjectPopup function, allowing remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. This can be exploited by injecting malicious code into the webpage.

Recommendations For Django versions 1.8.0 through 1.8.13, update to version 1.8.14 or later. For Django versions 1.9.0 through 1.9.7, update to version 1.9.8 or later. For Django versions 1.10.0 through 1.10.0rc1, update to version 1.10rc1 or later. As a temporary workaround, consider disabling the dismissChangeRelatedObjectPopup function until a patch is available.