CVE-2024-53908

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-53908
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53908.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-53908
Aliases
Downstream
Related
Published
2024-12-06T12:15:18Z
Modified
2025-09-24T12:32:39.859101Z
Summary
[none]
Details

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.haskey lookup via _ are unaffected.)

References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events

Affected versions

4.*

4.2
4.2.1
4.2.10
4.2.11
4.2.12
4.2.13
4.2.14
4.2.15
4.2.16
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9