Popular Django web framework affected by a SQL Injection flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-34265 | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. NVD description · AI analysis pending | 9.8 | 73% |
| — |
Full article186 words · extracted from securityaffairs.com · click to collapse
The development team behind the Django Project has addressed a high-severity SQL Injection flaw in its framework.
Django is a free and open-source, Python-based web framework that follows the model–template–views (MTV) architectural pattern. Django is maintained by the independent organization Django Software Foundation.
The latest releases of the framework, Django 4.0.6 and 3.2.14, addressed a high-severity SQL Injection vulnerability tracked as CVE-2022-34265.
According to the release note, the flaw resides in the Trunc() and Extract() database functions, it can be exploited if untrusted data was used as a kind/lookup_name value. Performing input sanitization for these functions it is possible to mitigate the risk of exploitation of the flaw.
“Trunc() and Extract() database functions were subject to SQL injection if untrusted data was used as a kind/lookup_name value.” reads the note. “Applications that constrain the lookup name and kind choice to a known safe list are unaffected.”
The development team also releases security patches as temporary solutions before upgrading to the latest versions.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SQL Injection)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/132853/security/django-framework-sql-injection.html