PT-2019-15772 · Django Software Foundation+1 · Django+1

Shen Ying · Published 2019-12-02 · Updated 2026-01-03 · CVE-2019-19118

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 2.1 through 2.1.14 Django versions 2.2 through 2.2.7

Description The issue allows unintended model editing in certain configurations. When a Django model admin displays inline related models and the user has view-only permissions to a parent model but edit permissions to the inline model, the user is presented with an editing UI. This UI allows POST requests for updating the inline model, which can trigger the parent model's save() method, even though directly editing the view-only parent model is not possible. This can cause potential side effects and invoke pre and post-save signal handlers.

Recommendations For Django versions 2.1 through 2.1.14, update to version 2.1.15 or later to resolve the issue. For Django versions 2.2 through 2.2.7, update to version 2.2.8 or later to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2020-1708

CVE-2019-19118

GHSA-HVMF-R92R-27HR

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2019-15

Affected Products

Alt Linux

Django

References · 94

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19118 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13887-1 · Vendor Advisory
• https://djangoproject.com/weblog/2019/dec/02/security-releases · Vendor Advisory
• https://security.gentoo.org/glsa/202004-17 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19118 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-19118 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/12/02/1 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10005-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hvmf-r92r-27hr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19118 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory