CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-53908
Critical (9.8) in djangoproject django. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in django 4.2.17, 5.0.10, 5.1.4.
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=5.0.0 <5.0.10 | 5.0.10 |
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=5.1.0 <5.1.4 | 5.1.4 |
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=4.2.0 <4.2.17 | 4.2.17 |
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=5.1 <5.1.4 | 5.1.4 |
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=5.0 <5.0.10 | 5.0.10 |
| GHSA-m9g8-fxxm-xg86 | PyPI | django | >=4.2 <4.2.17 | 4.2.17 |
| PYSEC-2024-157 | PyPI | django | >=5.1 <5.1.4 >=5.0 <5.0.10 >=4.2 <4.2.17 | 5.1.4, 5.0.10, 4.2.17 |