Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-34265

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Published

2022-07-04T16:15:09.260

Last Modified

2024-11-21T07:09:10.777

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	djangoproject	django	< 3.2.14	Yes
Application	djangoproject	django	< 4.0.6	Yes

References

https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory ([email protected])
https://groups.google.com/forum/#%21forum/django-announce ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ ([email protected])
https://security.netapp.com/advisory/ntap-20220818-0006/ Third Party Advisory ([email protected])
https://www.debian.org/security/2022/dsa-5254 Third Party Advisory ([email protected])
https://www.djangoproject.com/weblog/2022/jul/04/security-releases/ Patch, Vendor Advisory ([email protected])
https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://groups.google.com/forum/#%21forum/django-announce (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20220818-0006/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2022/dsa-5254 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.djangoproject.com/weblog/2022/jul/04/security-releases/ Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)