CVE-2022-28346

CRITICAL severity · CVSS 9.8 · SQL injection

9.8CVSS CRITICAL

Summary

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Django

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: http://www.openwall.com/lists/oss-security/2022/04/11/1 ↗

Additional information

NVD record
http://www.openwall.com/lists/oss-security/2022/04/11/1Patch
https://docs.djangoproject.com/en/4.0/releases/security/Patch
https://groups.google.com/forum/#%21forum/django-announce
https://lists.debian.org/debian-lts-announce/2022/04/msg00013.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://security.netapp.com/advisory/ntap-20220609-0002/Advisory
https://www.debian.org/security/2022/dsa-5254Advisory