GHSA-46x4-9jmv-jc8p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-46x4-9jmv-jc8p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-46x4-9jmv-jc8p/GHSA-46x4-9jmv-jc8p.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-46x4-9jmv-jc8p
- Aliases
- Published
- 2022-05-17T03:43:00Z
- Modified
- 2024-11-28T05:40:43.356101Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
- 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Django Access Restrictions Bypass
- Details
-
Django 1.9.x before 1.9.2, when
ModelAdmin.save_asis set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission. - Database specific
{ "nvd_published_at": "2016-02-08T19:59:00Z", "cwe_ids": [ "CWE-284" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-07-31T22:43:10Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2016-2048
- https://github.com/django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-14.yaml
- https://web.archive.org/web/20210123075529/http://www.securityfocus.com/bid/82329
- https://web.archive.org/web/20211204051406/http://www.securitytracker.com/id/1034894
- https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189
Affected packages
PyPI / django
Package
- Name
- django
- View open source insights on deps.dev
- Purl
- pkg:pypi/django