9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
70.2%
Severity: High
Date : 2022-04-12
CVE-ID : CVE-2022-28346 CVE-2022-28347
Package : python-django
Type : sql injection
Remote : Yes
Link : https://security.archlinux.org/AVG-2667
The package python-django before version 4.0.4-1 is vulnerable to sql
injection.
Upgrade to 4.0.4-1.
The problems have been fixed upstream in version 4.0.4.
None.
QuerySet.annotate(), aggregate(), and extra() methods were subject to
SQL injection in column aliases, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to these methods.
QuerySet.explain() method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options argument.
An attacker is able to perform an SQL injection via a specially crafted
input.
https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
https://security.archlinux.org/CVE-2022-28346
https://security.archlinux.org/CVE-2022-28347
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | python-django | < 4.0.4-1 | UNKNOWN |
github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
security.archlinux.org/AVG-2667
security.archlinux.org/CVE-2022-28346
security.archlinux.org/CVE-2022-28347
www.djangoproject.com/weblog/2022/apr/11/security-releases/
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
70.2%