by Kastro
Paper/Archive/CVE-2024-42005

CVE-2024-42005

djangoproject django — An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.3.743 × 2014.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
django4.2 – < 4.2.154.2.15CISA-ADP
django5.0 – < 5.0.85.0.8CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdocs.djangoproject.com/en/dev/releases/securityrefgroups.google.com/forum/#%21forum/django-announcerefdjangoproject.com/weblog/2024/aug/06/security-releasesrefsecurity.netapp.com/advisory/ntap-20240905-0007