Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2022-28346

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
djangoproject / django 4.0 4.0.4
djangoproject / django 3.2 3.2.13
djangoproject / django 2.2 2.2.28
debian / debian_linux 9.0 9.0.x
debian / debian_linux 11.0 11.0.x
Python icon Django 2.2 2.2.28
Python icon Django 3.2 3.2.13
Python icon Django 4.0 4.0.4