PT-2024-5584 · Django+5 · Django+5
Eyal Gabay
·
Published
2024-08-06
·
Updated
2026-01-03
·
CVE-2024-42005
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.14
Django versions 5.0 through 5.0.7
Description
The issue is related to SQL injection in the QuerySet.values() and values list() methods on models with a JSONField. This vulnerability can be exploited by passing a crafted JSON object key as an argument, allowing an attacker to execute arbitrary SQL queries. The estimated number of potentially affected devices worldwide is over 5.4 million services.
Recommendations
For Django versions 4.2 through 4.2.14, upgrade to Django 4.2.15.
For Django versions 5.0 through 5.0.7, upgrade to Django 5.0.8.
As a temporary workaround, consider restricting the use of the QuerySet.values() and values list() methods on models with a JSONField until a patch is available.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Django
Linuxmint
Ubuntu