Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | < 5.0.8 | 5.0.8 |
Miggo AIRoot Cause AnalysisThe vulnerability allows a low-privileged staff user to access content from pages they are not authorized to view. The primary entry point for this is the render_object_structure endpoint, which failed to enforce page-level view permissions. The provided patch confirms this by adding a call to user_can_view_page within the render_object_structure function in cms/views.py.
The same commit also fixes several related authorization bypasses in cms/admin/placeholderadmin.py. The functions _copy_plugin_to_clipboard, _copy_placeholder_to_clipboard, and move_plugin were also missing critical permission checks. These could be exploited to exfiltrate content from restricted pages by using the clipboard functionality or cause a denial of service by creating cycles in the plugin structure. The analysis of the patch 7642a98ab3170793c0b27b4125dd1f3d318b8a1c clearly shows the addition of these missing security checks in all identified functions, confirming they were vulnerable.
render_object_structurecms/views.py
PlaceholderAdmin._copy_plugin_to_clipboardcms/admin/placeholderadmin.py
PlaceholderAdmin._copy_placeholder_to_clipboardcms/admin/placeholderadmin.py
PlaceholderAdmin.move_plugincms/admin/placeholderadmin.py