CVE-2020-9402

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-9402
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9402.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-9402
Aliases
Downstream
Related
Published
2020-03-05T15:15:12Z
Modified
2025-09-30T08:14:07.264805Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events

Affected versions

1.*

1.11
1.11.1
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.16
1.11.17
1.11.18
1.11.19
1.11.2
1.11.20
1.11.21
1.11.22
1.11.23
1.11.24
1.11.25
1.11.26
1.11.27
1.11.28
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9