PT-2019-15772 · Django Software Foundation+1 · Django+1
Shen Ying
·
Publicado
2019-12-02
·
Atualizado
2026-01-03
·
CVE-2019-19118
CVSS v4.0
7.1
Alta
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 2.1 through 2.1.14
Django versions 2.2 through 2.2.7
Description
The issue allows unintended model editing in certain configurations. When a Django model admin displays inline related models and the user has view-only permissions to a parent model but edit permissions to the inline model, the user is presented with an editing UI. This UI allows POST requests for updating the inline model, which can trigger the parent model's save() method, even though directly editing the view-only parent model is not possible. This can cause potential side effects and invoke pre and post-save signal handlers.
Recommendations
For Django versions 2.1 through 2.1.14, update to version 2.1.15 or later to resolve the issue.
For Django versions 2.2 through 2.2.7, update to version 2.2.8 or later to resolve the issue.
Correção
Incorrect Default Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Django