CVEvulnerability
CVE-2022-28346
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Affected configurations
• djangoproject django (>= 2.2 < 2.2.28)
• djangoproject django (>= 3.2 < 3.2.13)
• djangoproject django (>= 4.0 < 4.0.4)
• debian debian linux 9.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://www.openwall.com/lists/oss-security/2022/04/11/1 Mailing List, Patch, Third Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220609-0002/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254 Third Party Advisory
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/04/11/1 Mailing List, Patch, Third Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220609-0002/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254 Third Party Advisory
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ Patch, Vendor Advisory