Unintended Model Editing in Django - CVE-2019-19118
Summary
CVE-2019-19118: Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. Affects python-django across 2 version ranges.
< 2:2.2.8-1
>= e7ad40fcf4b103bb5134f6a94eb86a4e10e53cb3, < 3baf68b4efc660ff68fd246d2f7092bfd42a7a4a
Fixed in 2:2.2.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an admin interface for managing application data. However, certain configurations can lead to security vulnerabilities, such as unintended model editing, which can compromise data integrity and application behavior.
Vulnerability Detail
The vulnerability identified as CVE-2019-19118 affects Django versions 2.1 before 2.1.15 and 2.2 before 2.2.8. It allows users with view-only permissions on a parent model to access an editing interface for inline related models, despite lacking edit permissions on the parent model. This can lead to unintended modifications through POST requests, invoking the parent model's save() method and triggering potential side effects, including the execution of pre and post-save signal handlers.
How To Fix
Minimum fixed version
2:2.2.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users with view-only permissions do not have access to the admin interface for inline related models. This can be achieved by modifying the admin configuration to restrict access based on user permissions.
Conclusion
CVE-2019-19118 presents a significant risk for applications using affected versions of Django, allowing unintended model editing under certain permission configurations. It is crucial to upgrade to the fixed versions to mitigate this vulnerability and maintain application integrity.
See every vulnerability recorded for python-django →
FAQ
CVE-2019-19118 is a vulnerability in Django that allows unintended editing of inline related models by users who should only have view permissions on the parent model.
Django versions 2.1 before 2.1.15 and 2.2 before 2.2.8 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized modifications to data, triggering unintended side effects in the application, and potential data integrity issues.
The CVSS score for CVE-2019-19118 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
