Vulnerability Description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 2.2, < 2.2.28 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/04/11/1Mailing ListPatchThird Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/PatchVendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20220609-0002/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254Third Party Advisory
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/PatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2022/04/11/1Mailing ListPatchThird Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/PatchVendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-28346?
CVE-2022-28346 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a...
How severe is CVE-2022-28346?
CVE-2022-28346 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-28346?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Debian Debian Linux.