Vulnerability advisory
CVE-2024-53908
Also known as BIT-django-2024-53908GHSA-m9g8-fxxm-xg86PYSEC-2024-157
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 1f0356ff2af11a5fa71fb07b4627e10edd170438 | 1f0356ff2af11a5fa71fb07b4627e10edd170438 |
| 52821001bb62b764d73e63812133f199b8fef9eb to before 3b3a5f4efbf93692557b7f473519bd0ad8f04c6a | 3b3a5f4efbf93692557b7f473519bd0ad8f04c6a |
| 84d09a547fe35e10018ab242602ca76c29ca91a1 to before 2d4add11fd57b05f7ea48e8b3e89e743c9871aa3 | 2d4add11fd57b05f7ea48e8b3e89e743c9871aa3 |
Description
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)