CVE-2024-42005

CVE Enrichment

CVSS: 7.3 HIGH
EPSS: 1.50%
EPSS Percentile: 74.16%
CISA KEV: Not listed

Description

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 07-Aug-2024 22:15
Last Modified: 17-Jun-2026 14:48
EPSS Date: 2026-10-24
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:L /
                            A:L

Affected Products / Versions

djangoproject / django
Version / affected range: * · from (inclusive) 4.2 · before (exclusive) 4.2.15
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
djangoproject / django
Version / affected range: * · from (inclusive) 5.0 · before (exclusive) 5.0.8
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

References

Last enrichment sync: 25-Oct-2026 07:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Django's CVE-2024-42005 is an example. Two of Django's own query methods, used to read fields out of a JSON column, dropped the field names you passed straight into the SQL without cleaning them, so an attacker who Why SQL Injection Still Persists Despite Decades-Old Fixes

People (2)

MITRE ATT&CK (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.