Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-django | Jul 30, 2024 | Feb 8, 2016 |
| Freebsd | — | Upgrade py27-django-develUpgrade py34-django19Upgrade py33-django19Upgrade py33-django-develUpgrade py34-django-develUpgrade py35-django-develUpgrade py35-django19Upgrade py27-django19 | Dec 10, 2025 | Feb 28, 2016 |
| Suse | — | Upgrade python-djangoUpgrade python3-django | Mar 28, 2018 | Feb 8, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub