Django up to 2.1.14/2.2.7 save POST Request default permission

Summaryinfo

A vulnerability, which was classified as critical, has been found in Django up to 2.1.14/2.2.7. This affects the function Save. This manipulation as part of POST Request causes default permission. The identification of this vulnerability is CVE-2019-19118. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Django up to 2.1.14/2.2.7 (Content Management System). Affected by this vulnerability is the function save. The manipulation as part of a POST Request leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

The weakness was shared 12/02/2019 (oss-sec). It is possible to read the advisory at openwall.com. This vulnerability is known as CVE-2019-19118. The attack can be launched remotely. The successful exploitation needs a single authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 2.1.15 or 2.2.8 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion