Description

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Remediation

References

CVE-2022-28346

Related Vulnerabilities

TYPO3 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-11069)

WordPress Ultimate Member Plugin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14946)

Drupal Core 7.x Multiple Vulnerabilities (7.0)

WordPress Plugin YITH WooCommerce Zoom Magnifier Cross-Site Scripting (1.2.6)

PrestaShop Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-19595)

Severity

Critical

Classification

CVE-2022-28346 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities