Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
@mis4nthr0pic @lumatechdev Não entendi. Quem está usando Django 2.2 como no caso do CVE-2022-28346 ? Você juntou um monte de CVE da história do Django?
Post summary
The tweet merely asks who might be using Django 2.2 with reference to CVE-2022-28346, without providing any technical details, PoC, or evidence of exploitation.
@kwast @lumatechdev erro gravíssimo 1. CVE-2013-1443 2. CVE-2019-6975 3. CVE-2021-33203 4. CVE-2022-28346 5. CVE-2016-7401
Post summary
The tweet merely lists several CVE identifiers without providing any additional context, details, or actionable information.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 9.0 | - | - |
| App | djangoproject | django | - | - | - |