Detections
Analytics

SCA: security update for Django (GHSA-hvmf-r92r-27hr)

high Tenable Cloud Security Plugin ID 422986

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin
 displaying inline related models, where the user has view-only permissions to a parent model but edit
 permissions to the inline model, would be presented with an editing UI, allowing POST requests, for
 updating the inline model. Directly editing the view-only parent model was not possible, but the parent
 model's save() method was called, triggering potential side effects, and causing pre and post-save signal
 handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the
 parent model in order for inline models to be editable.) (CVE-2019-19118)

See Also

https://github.com/advisories/GHSA-hvmf-r92r-27hr

Plugin Details

Severity: High

ID: 422986

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/29/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2019-19118

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/4/2019

Vulnerability Publication Date: 12/2/2019

Reference Information

CVE: CVE-2019-19118

cwe: CWE-276