CVE-2019-19118

2 advisories.

PyPI/django CVE-2019-19118: medium 6.5, EPSS 1.67%

Django allows unintended model editing

Action: Upgrade django to 2.1.15 or later.

pip install django==2.1.15

pip install django==2.2.8

Affected

introduced	fixed	last affected
2.1	2.1.15	-
2.2	2.2.8	-

Fixed versions

2.1.15

2.2.8

Sources

osv: GHSA-hvmf-r92r-27hr
https://nvd.nist.gov/vuln/detail/CVE-2019-19118
https://github.com/django/django/commit/103ebe2b5ff1b2614b85a52c239f471904d26244
https://github.com/django/django/commit/36f580a17f0b3cb087deadf3b65eea024f479c21
https://docs.djangoproject.com/en/dev/releases/security
https://github.com/advisories/GHSA-hvmf-r92r-27hr
https://github.com/django/django
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-15.yaml
https://groups.google.com/forum/#!topic/django-announce/GjGqDvtNmWQ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5
https://security.gentoo.org/glsa/202004-17
https://security.netapp.com/advisory/ntap-20191217-0003
https://www.djangoproject.com/weblog/2019/dec/02/security-releases
http://www.openwall.com/lists/oss-security/2019/12/02/1

CVE-2019-19118 · published 2019-12-04T21:26:28Z · modified 2024-11-19T05:33:19.050183Z · JSON

PyPI/django CVE-2019-19118: unknown, EPSS 1.67%

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edi