Description
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
Remediation
References
Related Vulnerabilities
MySQL CVE-2012-0492 Vulnerability (CVE-2012-0492)
Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-7913)
WordPress Plugin UpdraftPlus WordPress Backup Security Bypass (1.9.50)
MySQL CVE-2018-2778 Vulnerability (CVE-2018-2778)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-2687)