GHSA-rw75-m7gp-92m3 Django data leakage via querystring manipulation in admin

• PyPI Django: < 1.4.14 → fixed in 1.4.14 • PyPI Django: >= 1.5, < 1.5.9 → fixed in 1.5.9 • PyPI Django: >= 1.6, < 1.6.6 → fixed in 1.6.6 • PyPI Django: >= 1.7a1, < 1.7c3 → fixed in 1.7c3

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a `/admin/auth/user/?pop=1&t=password` URI.