Description
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
Remediation
References
Related Vulnerabilities
WordPress 5.8.x Multiple Vulnerabilities (5.8 - 5.8.2)
WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler PHP Object Injection (5.0.0)
Python CVE-2019-16056 Vulnerability (CVE-2019-16056)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3390)
WordPress Plugin Advanced Shipment Tracking for WooCommerce Security Bypass (3.2.6)