2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org/project/Django/","defaultStatus":"unaffected","packageName":"django","product":"Django","repo":"https://github.com/django/django/","vendor":"djangoproject","versions":[{"lessThan":"6.0.4","status":"affected","version":"6.0","versionType":"semver"},{"status":"unaffected","version":"6.0.4","versionType":"semver"},{"lessThan":"5.2.13","status":"affected","version":"5.2","versionType":"semver"},{"status":"unaffected","version":"5.2.13","versionType":"semver"},{"lessThan":"4.2.30","status":"affected","version":"4.2","versionType":"semver"},{"status":"unaffected","version":"4.2.30","versionType":"semver"}]}],"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"C78D8198-229F-45A2-B09D-C1D272878E3E","versionEndExcluding":"4.2.30","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"5ED295FD-7063-40A1-9A3E-C0CC4D6F7BD3","versionEndExcluding":"5.2.13","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*","matchCriteriaId":"344A677E-BD67-42F0-9746-5B0D4C53815E","versionEndExcluding":"6.0.4","versionStartIncluding":"6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue."},{"lang":"es","value":"Se descubrió un problema en 6.0 anterior a 6.0.4, 5.2 anterior a 5.2.13 y 4.2 anterior a 4.2.30.\nLos formularios de lista de cambios de administración que utilizan ’ModelAdmin.list_editable’ permitieron de forma incorrecta la creación de nuevas instancias mediante datos ’POST’ falsificados.\nSeries de Django anteriores no compatibles (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y también podrían verse afectadas.\nDjango desea agradecer a Cantina por reportar este problema."}],"id":"CVE-2026-4292","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-07T15:12:50.786633Z","version":"2.0.3"}}]},"published":"2026-04-07T15:17:46.650","references":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Patch","Vendor Advisory"],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Release Notes"],"url":"https://groups.google.com/g/django-announce"},{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":["Patch","Vendor Advisory"],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary"}]}
|