CNVD-2015-01672 | Vulnetix

CNVD-2015-01672 PUBLISHED

Record from circl · Published March 12, 2015

Django是Django软件基金会的一个采用Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 1.7.5及之前版本和1.8 beta1版本admin/helpers.py文件中的‘contents’函数存在跨站脚本漏洞。远程攻击者利用该漏洞可借助ModelAdmin.readonly_fields中的‘model’属性注入任意Web脚本或HTML。

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CNVD-2015-01672
vulnetix vdb fixes CNVD-2015-01672

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CNVD-2015-01672/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

Look up in the Resolve Platform →