CVE-2024-42005

2024-08-0700:00:00

mitre

github.com

django

sql injection

jsonfield

AI Score

8.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "vendor": "djangoproject",
    "product": "django",
    "versions": [
      {
        "status": "affected",
        "version": "4.2",
        "lessThan": "4.2.15",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.0",
        "lessThan": "5.0.8",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]