An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.
References
Link | Resource |
---|---|
https://docs.djangoproject.com/en/dev/releases/security/ | Patch Vendor Advisory |
https://groups.google.com/forum/#%21forum/django-announce | Not Applicable |
https://www.djangoproject.com/weblog/2024/aug/06/security-releases/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Oct 2024, 18:22
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
03 Sep 2024, 18:35
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
07 Aug 2024, 20:48
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-89 | |
References | () https://docs.djangoproject.com/en/dev/releases/security/ - Patch, Vendor Advisory | |
References | () https://groups.google.com/forum/#%21forum/django-announce - Not Applicable | |
References | () https://www.djangoproject.com/weblog/2024/aug/06/security-releases/ - Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
First Time |
Djangoproject
Djangoproject django |
|
CPE | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
07 Aug 2024, 15:17
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-07 15:15
Updated : 2024-10-23 18:22
NVD link : CVE-2024-42005
Mitre link : CVE-2024-42005
CVE.ORG link : CVE-2024-42005
JSON object : View
Products Affected
djangoproject
- django
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')