Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-03-05T14:49:57
Updated: 2024-08-04T10:26:16.139Z
Reserved: 2020-02-25T00:00:00
Link: CVE-2020-9402
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-03-05T15:15:12.410
Modified: 2024-11-21T05:40:33.953
Link: CVE-2020-9402
Redhat