← Back

CVE-2016-2048

nvd nist
Published: Feb 8, 2016Modified: May 6, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Exploitability: 1.2 / Impact: 4.2
Source: NVD

Description

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

Affected (2)

Djangoproject
1 product
Django
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
Version 1.9.1
Django
Version 1.9

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (6)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.