CVE-2016-2048

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create…

published February 8, 2016

CVSS
—
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01535 · 74.5th percentile
Published
2016-02-08T19:00Z
EPSS history
Timeline
  • 08 FEB 19:00Z
    Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create…
    cvelistv5