cve.bz

CVE-2022-28347

9.8 criticalEPSS 2.9%

Critical (9.8). EPSS 2.9% chance of exploitation in the next 30 days. Fixed in django 2.2.28, 3.2.13, 4.0.4.

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
2.9% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-89
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w24h-v9qh-8gxjPyPIdjango>=2.2 <2.2.282.2.28
GHSA-w24h-v9qh-8gxjPyPIdjango>=3.2 <3.2.133.2.13
GHSA-w24h-v9qh-8gxjPyPIdjango>=4.0 <4.0.44.0.4
PYSEC-2022-191PyPIdjango>=4.0 <4.0.4
>=3.2 <3.2.13
>=2.2 <2.2.28		4.0.4, 3.2.13, 2.2.28

References

Check your stackJSON