2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org/project/Django/","defaultStatus":"unaffected","packageName":"django","product":"Django","repo":"https://github.com/django/django/","vendor":"djangoproject","versions":[{"lessThan":"6.0.4","status":"affected","version":"6.0","versionType":"semver"},{"status":"unaffected","version":"6.0.4","versionType":"semver"},{"lessThan":"5.2.13","status":"affected","version":"5.2","versionType":"semver"},{"status":"unaffected","version":"5.2.13","versionType":"semver"},{"lessThan":"4.2.30","status":"affected","version":"4.2","versionType":"semver"},{"status":"unaffected","version":"4.2.30","versionType":"semver"}]}],"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"C78D8198-229F-45A2-B09D-C1D272878E3E","versionEndExcluding":"4.2.30","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"5ED295FD-7063-40A1-9A3E-C0CC4D6F7BD3","versionEndExcluding":"5.2.13","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"344A677E-BD67-42F0-9746-5B0D4C53815E","versionEndExcluding":"6.0.4","versionStartIncluding":"6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\r\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank N05ec@LZU-DSLab for reporting this issue."},{"lang":"es","value":"Se descubrió un problema en 6.0 antes de 6.0.4, 5.2 antes de 5.2.13 y 4.2 antes de 4.2.30.\nLos permisos de adición en instancias de modelos en línea no se validaron al enviar datos ’POST’ falsificados en ’GenericInlineModelAdmin’.\nSeries de Django anteriores no soportadas (como 5.0.x, 4.1.x y 3.2.x) no se evaluaron y también pueden estar afectadas.\nDjango desea agradecer a N05ec@LZU-DSLab por informar de este problema."}],"id":"CVE-2026-4277","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4277","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-09T18:09:56.739026Z","version":"2.0.3"}}]},"published":"2026-04-07T15:17:46.500","references":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Patch","Vendor Advisory"],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Release Notes"],"url":"https://groups.google.com/g/django-announce"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Patch","Vendor Advisory"],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary"}]}
|