Lucene search

GitHub Advisory DatabaseGHSA-W24H-V9QH-8GXJ

HistoryApr 13, 2022 - 12:00 a.m.

SQL Injection in Django

2022-04-1300:00:33

CWE-89

GitHub Advisory Database

github.com

django version 2.2

django version 3.2

django version 4.0

sql injection

queryset.explain()

crafted dictionary

injection payload

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

75.1%

JSON

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

Affected configurations

Vulners

Node

djangoRange4.0–4.0.4

djangoRange3.2–3.2.13

djangoRange2.2–2.2.28

VendorProductVersionCPE
*django*cpe:2.3:a:*:django:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	django	*	cpe:2.3:a::django::::::::*

References

www.openwall.com/lists/oss-security/2022/04/11/1

docs.djangoproject.com/en/4.0/releases/security

github.com/advisories/GHSA-w24h-v9qh-8gxj

github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402

github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5

github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81

github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d

github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml

groups.google.com/forum/#!forum/django-announce

lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK

lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI

nvd.nist.gov/vuln/detail/CVE-2022-28347

www.debian.org/security/2022/dsa-5254

www.djangoproject.com/weblog/2022/apr/11/security-releases

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

75.1%

JSON

Related for GHSA-W24H-V9QH-8GXJ