The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not proper

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• djangoproject djangoup to 1.1.2 inclusive
• djangoproject django0.91
• djangoproject django0.95
• djangoproject django0.95.1
• djangoproject django0.96
• djangoproject django1.0
• djangoproject django1.0.1
• djangoproject django1.0.2
• djangoproject django1.1
• djangoproject django1.1.0
• djangoproject django1.2
• djangoproject django1.2.1
• djangoproject django1.2.2
• djangoproject django1.2.3
• djangoproject django1.3

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-34265An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
  61This week
• CVE-2020-7471Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter
  59Plan
• CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
  55Plan
• CVE-2019-14234An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
  53Plan
• CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w
  52Plan
• CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.
  49Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.