Django up to 1.10.28/2.2.10/3.0.3 tolerance sql injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Django up to 1.10.28/2.2.10/3.0.3. Affected by this vulnerability is an unknown functionality. Executing a manipulation of the argument tolerance as part of Parameter can lead to sql injection. The identification of this vulnerability is CVE-2020-9402. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Django up to 1.10.28/2.2.10/3.0.3 (Content Management System). It has been declared as critical. This vulnerability affects some unknown functionality. The manipulation of the argument tolerance as part of a Parameter leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

The weakness was shared 03/05/2020 (Website). The advisory is shared for download at djangoproject.com. This vulnerability was named CVE-2020-9402 since 02/25/2020. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 1.10.29, 2.2.11 or 3.0.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.10.8
• 1.10.9
• 1.10.10
• 1.10.11
• 1.10.12
• 1.10.13
• 1.10.14
• 1.10.15
• 1.10.16
• 1.10.17
• 1.10.18
• 1.10.19
• 1.10.20
• 1.10.21
• 1.10.22
• 1.10.23
• 1.10.24
• 1.10.25
• 1.10.26
• 1.10.27
• 1.10.28
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.10
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion