« Volver al listado

CVE-2016-2048

Estado: ModificadaMedia (5.5)—

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Djangoproject — Django

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-2048",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-02-08T19:59:05.470",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/82329",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1034894",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/82329",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034894",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the \"Save as New\" option when editing objects and leveraging the \"change\" permission."
    },
    {
      "lang": "es",
      "value": "Django 1.9.x en versiones anteriores a 1.9.2, cuando ModelAdmin.save_as se establece a verdadero, permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y crear objetos ModelAdmin a través de la opción \"Save as New\" cuando se editan objetos y se aprovecha el permiso \"change\"."
    }
  ],
  "lastModified": "2026-06-17T00:43:19.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29C40BAC-6DF3-4EA2-A65A-86462DDD8723"
            },
            {
              "criteria": "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B754401-8503-4553-853F-4F6BCD2D2FF2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}