vulnwire
5.5med

CVE-2016-2048

Django Access Restrictions Bypass

Also known as GHSA-46x4-9jmv-jc8p, PYSEC-2016-14

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

Exploit prediction (EPSS)

1.53% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
NVD2.06.0AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub3.05.5CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
pypidjango
>=1.9, <1.9.2
1.9.2

Classification

Weakness
Technology feeds
Django (RSS, critical only)

References

  • djangoproject.com /weblog/2016/feb/01/releases-192-and-189/ · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/82329 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1034894 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-2048 · advisory
  • github.com /django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265 · web
  • github.com /django/django · package
  • github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-14.yaml · web
  • web.archive.org /web/20210123075529/http://www.securityfocus.com/bid/82329 · web
  • web.archive.org /web/20211204051406/http://www.securitytracker.com/id/1034894 · web
  • djangoproject.com /weblog/2016/feb/01/releases-192-and-189 · web
  • github.com /advisories/GHSA-46x4-9jmv-jc8p · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.