Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-34265

Good to know:

icon
icon

Date: July 3, 2022

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. After conducting further research, Mend has determined that all versions of Django before version 3.2.14 and before 4.0.6 are vulnerable to CVE-2022-34265.

Language: Python

Severity Score

Related Resources (23)

https://nvd.nist.gov/vuln/detail/CVE-2022-34265
https://github.com/advisories/GHSA-p64x-8rxx-wf6q
https://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
https://docs.djangoproject.com/en/4.0/releases/security
https://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://security.netapp.com/advisory/ntap-20220818-0006
https://www.djangoproject.com/weblog/2022/jul/04/security-releases
https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
https://github.com/django/django
https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
https://security.netapp.com/advisory/ntap-20220818-0006/
https://docs.djangoproject.com/en/4.0/releases/security/
https://security-tracker.debian.org/tracker/CVE-2022-34265
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://groups.google.com/forum/#!forum/django-announce
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
https://groups.google.com/forum/#%21forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
https://www.debian.org/security/2022/dsa-5254
https://www.mend.io/vulnerability-database/CVE-2022-34265

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89

Top Fix

icon

Upgrade Version

Upgrade to version django - 3.2.14;django - 4.0.6;django - 3.2.14

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us