CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions…

published March 5, 2020

CVSS
—
EPSS
23%
Percentile
97.7
In the wild
Unconfirmed
What it is

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.22513 · 97.7th percentile
Published
2020-03-05T14:49Z
EPSS history
Timeline
  • 05 MAR 14:49Z
    Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions…
    cvelistv5