Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to
    bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when
    editing objects and leveraging the "change" permission. (CVE-2016-2048)

This update for python3-Django to version 1.18.18 fixes multiple issues. Security issues fixed :

  - CVE-2018-7537: Fixed catastrophic backtracking in     django.utils.text.Truncator. (bsc#1083305)

  - CVE-2018-7536: Fixed catastrophic backtracking in urlize     and urlizetrunc template filters (bsc#1083304).

  - CVE-2016-7401: CSRF protection bypass on a site with     Google Analytics (bsc#1001374).

  - CVE-2016-2513: User enumeration through timing     difference on password hasher work factor upgrade     (bsc#968000).

  - CVE-2016-2512: Fixed malicious redirect and possible XSS     attack via user-supplied redirect URLs containing basic     auth (bsc#967999).

  - CVE-2016-9013: User with hardcoded password created when     running tests on Oracle (bsc#1008050).

  - CVE-2016-9014: DNS rebinding vulnerability when     DEBUG=True (bsc#1008047).

  - CVE-2017-7234: Open redirect vulnerability in     django.views.static.serve() (bsc#1031451).

  - CVE-2017-7233: Open redirect and possible XSS attack via     user-supplied numeric redirect URLs (bsc#1031450).

  - CVE-2017-12794: Fixed XSS possibility in traceback     section of technical 500 debug page (bsc#1056284)

This update for python-Django to version 1.18.18 fixes multiple issues. Security issues fixed :

  - CVE-2018-7537: Fixed catastrophic backtracking in     django.utils.text.Truncator. (bsc#1083305)

  - CVE-2018-7536: Fixed catastrophic backtracking in urlize     and urlizetrunc template filters (bsc#1083304).

  - CVE-2016-7401: CSRF protection bypass on a site with     Google Analytics (bsc#1001374).

  - CVE-2016-2513: User enumeration through timing     difference on password hasher work factor upgrade     (bsc#968000).

  - CVE-2016-2512: Fixed malicious redirect and possible XSS     attack via user-supplied redirect URLs containing basic     auth (bsc#967999).

  - CVE-2016-9013: User with hardcoded password created when     running tests on Oracle (bsc#1008050).

  - CVE-2016-9014: DNS rebinding vulnerability when     DEBUG=True (bsc#1008047).

  - CVE-2017-7234: Open redirect vulnerability in     django.views.static.serve() (bsc#1031451).

  - CVE-2017-7233: Open redirect and possible XSS attack via     user-supplied numeric redirect URLs (bsc#1031450).

  - CVE-2017-12794: Fixed XSS possibility in traceback     section of technical 500 debug page (bsc#1056284)

Tim Graham reports :

User with 'change' but not 'add' permission can create objects for ModelAdmin's with save_as=True

ID	Name	Product	Family	Severity
432980	SCA: security update for django (GHSA-46x4-9jmv-jc8p)	Tenable Cloud Security	SCA Checks	high
432980	SCA: security update for django (GHSA-46x4-9jmv-jc8p)	Tenable Self-Hosted Container Security	SCA Checks	high
108641	openSUSE Security Update : python3-Django (openSUSE-2018-318)	Nessus	SuSE Local Security Checks	critical
108640	openSUSE Security Update : python-Django (openSUSE-2018-317)	Nessus	SuSE Local Security Checks	critical
89009	FreeBSD : django -- regression in permissions model (6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-2048

high

Tenable Plugins

high

high

critical

critical

medium