Описание
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 3:5.2.4-1ubuntu2 |
| esm-infra-legacy/trusty | released | 1.6.11-0ubuntu1.3+esm8 |
| esm-infra-legacy/xenial | released | 1.8.7-1ubuntu5.15+esm9 |
| esm-infra/bionic | released | 1:1.11.11-1ubuntu1.21+esm12 |
| esm-infra/focal | released | 2:2.2.12-1ubuntu0.29+esm4 |
| esm-infra/xenial | released | 1.8.7-1ubuntu5.15+esm9 |
| jammy | released | 2:3.2.12-2ubuntu1.22 |
| noble | released | 3:4.2.11-1ubuntu1.11 |
| plucky | released | 3:4.2.18-1ubuntu1.5 |
| questing | released | 3:5.2.4-1ubuntu2 |
Показывать по
EPSS
7.1 High
CVSS3
Связанные уязвимости
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13 ...
Django vulnerable to SQL injection in column aliases
Уязвимость методов QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() программной платформы для веб-приложений Django, позволяющая нарушителю оказать влияние на конфиденциальность и целостность защищаемой информации
EPSS
7.1 High
CVSS3