PT-2026-30870 · Django+3 · Django+3
CVSS v2.0
4.0
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Django versions 6.0 through 6.0.3
Django versions 5.2 through 5.2.12
Django versions 4.2 through 4.2.29
Django versions 5.0.x and earlier
Django versions 4.1.x and earlier
Django versions 3.2.x and earlier
Description
An issue was discovered where admin changelist forms using
ModelAdmin.list editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Recommendations
Update to Django version 6.0.4 or later.
Update to Django version 5.2.13 or later.
Update to Django version 4.2.30 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django
Linuxmint
Red Os
Ubuntu