PYSEC-2022-191
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2022-191.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2022-191
- Aliases
- Published
- 2022-04-12T05:15:00Z
- Modified
- 2023-12-06T01:02:11.666037Z
- Summary
- [none]
- Details
-
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
- References
Affected packages
PyPI / django
Package
- Name
- django
- View open source insights on deps.dev
- Purl
- pkg:pypi/django
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced4.0Fixed4.0.4Introduced3.2Fixed3.2.13Introduced2.2Fixed2.2.28
Affected versions
2.*
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.26
2.2.27
3.*
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
4.*
4.0
4.0.1
4.0.2
4.0.3