Lucene search

[email protected]NVD:CVE-2024-42005

HistoryAug 07, 2024 - 3:15 p.m.

CVE-2024-42005

2024-08-0715:15:56

CWE-89

[email protected]

web.nvd.nist.gov

django

queryset

sql injection

jsonfield

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.6%

JSON

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Affected configurations

Nvd

Node

djangoprojectdjangoRange4.2–4.2.15

djangoprojectdjangoRange5.0–5.0.8

VendorProductVersionCPE
djangoprojectdjango*cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
djangoproject	django	*	cpe:2.3:a:djangoproject:django::::::::

References

docs.djangoproject.com/en/dev/releases/security/

groups.google.com/forum/#%21forum/django-announce

www.djangoproject.com/weblog/2024/aug/06/security-releases/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.6%

JSON

Related for NVD:CVE-2024-42005

osv6 github1 ubuntucve1 cvelist1 hackerone1 debiancve1 vulnrichment1 cve1 veracode1 redhatcve1 openvas3 nessus5 ubuntu1 freebsd1 redhat1