Description
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
Published: 2024-12-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-0049 An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
Github GHSA Github GHSA GHSA-m9g8-fxxm-xg86 Django SQL injection in HasKey(lhs, rhs) on Oracle
Ubuntu USN Ubuntu USN USN-7136-1 Django vulnerabilities
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00142}

 epss

{'score': 0.00217}

Tue, 17 Dec 2024 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat ansible Automation Platform
CPEs cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9
cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
Vendors & Products Redhat
Redhat ansible Automation Platform

Fri, 06 Dec 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Djangoproject
Djangoproject django
CPEs cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
Vendors & Products Djangoproject
Djangoproject django
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 06 Dec 2024 12:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries. An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
References

Thu, 05 Dec 2024 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries.
Title django: Potential SQL injection in HasKey(lhs, rhs) on Oracle
Weaknesses CWE-89
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important

Subscriptions

Djangoproject Django
Redhat Ansible Automation Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-12-06T16:22:02.446Z

Reserved: 2024-11-24T00:00:00.000Z

Link: CVE-2024-53908

cve-icon Vulnrichment

Updated: 2024-12-06T16:21:55.404Z

cve-icon NVD

Status : Analyzed

Published: 2024-12-06T12:15:18.583

Modified: 2025-06-09T19:51:17.797

Link: CVE-2024-53908

cve-icon Redhat

Severity : Important

Publid Date: 2024-12-04T00:00:00Z

Links: CVE-2024-53908 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses