PT-2024-9187 · Django+6 · Django+6
Seokchan Yoon
·
Published
2024-12-04
·
Updated
2026-01-03
·
CVE-2024-53908
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Django versions 4.2 through 4.2.17
Django versions 5.0 through 5.0.10
Django versions 5.1 through 5.1.4
Description:
An issue was discovered in Django when using an Oracle database. Direct usage of the
django.db.models.fields.json.HasKey lookup is subject to SQL injection if untrusted data is used as an lhs value. This issue can be exploited by a remote attacker to execute arbitrary SQL code by sending a specially crafted request.Recommendations:
For Django versions 4.2 through 4.2.17, upgrade to version 4.2.17 or later.
For Django versions 5.0 through 5.0.10, upgrade to version 5.0.10 or later.
For Django versions 5.1 through 5.1.4, upgrade to version 5.1.4 or later.
As a temporary workaround, consider avoiding the use of the
django.db.models.fields.json.HasKey lookup with untrusted data until a patch is applied.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Django
Linuxmint
Red Os
Suse
Ubuntu