by Kastro
Paper/Archive/CVE-2022-28346

CVE-2022-28346

mitre — An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.

EPSS 19%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgroups.google.com/forum/#%21forum/django-announcerefdocs.djangoproject.com/en/4.0/releases/securityrefopenwall.com/lists/oss-security/2022/04/11/1refdjangoproject.com/weblog/2022/apr/11/security-releasesreflists.debian.org/debian-lts-announce/2022/04/msg00013.htmlrefsecurity.netapp.com/advisory/ntap-20220609-0002advisorydebian.org/security/2022/dsa-5254advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IKadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI