CVE-2022-28346

CVE-2022-28346

Published · Updated

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 19%
exploitation probability
19%top 3% of all CVEs
observed exploitation
nono source reports it
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Affected products
n/a · n/a
References
https://docs.djangoproject.com/en/4.0/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.debian.org/debian-lts-announce/2022/04/msg00013.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/https://security.netapp.com/advisory/ntap-20220609-0002/https://www.debian.org/security/2022/dsa-5254https://www.djangoproject.com/weblog/2022/apr/11/security-releases/http://www.openwall.com/lists/oss-security/2022/04/11/1