Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin
    displaying inline related models, where the user has view-only permissions to a parent model but edit
    permissions to the inline model, would be presented with an editing UI, allowing POST requests, for
    updating the inline model. Directly editing the view-only parent model was not possible, but the parent
    model's save() method was called, triggering potential side effects, and causing pre and post-save signal
    handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the
    parent model in order for inline models to be editable.) (CVE-2019-19118)

The remote host is affected by the vulnerability described in GLSA-202004-17 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending specially crafted input, could possibly       cause a Denial of Service condition, or alter the database.
  Workaround :

    There is no known workaround at this time.

bugfix release for CVE-2019-19118

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Django release reports :

CVE-2019-19118: Privilege escalation in the Django admin.

Since Django 2.1, a Django model admin displaying a parent model with related model inlines, where the user has view-only permissions to a parent model but edit permissions to the inline model, would display a read-only view of the parent model but editable forms for the inline.

Submitting these forms would not allow direct edits to the parent model, but would trigger the parent model's save() method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals.

ID	Name	Product	Family	Type	Severity
422986	SCA: security update for Django (GHSA-hvmf-r92r-27hr)	Tenable Cloud Security	SCA Checks	Local	high
422986	SCA: security update for Django (GHSA-hvmf-r92r-27hr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
136216	GLSA-202004-17 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
132270	Fedora 31 : python-django (2019-adc8990386)	Nessus	Fedora Local Security Checks	Local	medium
131470	FreeBSD : Django -- multiple vulnerabilities (4e3fa78b-1577-11ea-b66e-080027bdabe8)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-19118

high

Tenable Plugins

high

high

critical

medium

medium