-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | < 1.4.14 | 1.4.14 |
| Django | pip | >= 1.5, < 1.5.9 | 1.5.9 |
| Django | pip | >= 1.6, < 1.6.6 | 1.6.6 |
| Django | pip | >= 1.7a1, < 1.7c3 | 1.7c3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing validation of the 'to_field' parameter in admin interface handlers. The patch added 'to_field_allowed()' checks in both the changeform_view (admin form handler) and ChangeList initialization (list view handler). The original unpatched versions of these functions processed 'to_field' without verifying it was a relationship field to a registered model, allowing attackers to expose arbitrary fields via URL manipulation.