Vulnetix
Try Vulnetix Request Demo
CVE-2022-34265 PUBLISHED

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

EPSS 92.83% · 99.8th percentile

Risk Scores

EPSS Score
92.83%
99.8th percentile

Affected Products

VendorProductVersions
Bitnamidjango3.2.0, 4.0.0
Bitnamidjango3.2.0, 4.0.0, 3.2.0

Timeline

References

Open in Interactive Console →