Search for vulnerabilities
Vulnerability details: VCID-2v6w-xtrj-aaag
Vulnerability ID VCID-2v6w-xtrj-aaag
Aliases BIT-2022-28347
BIT-django-2022-28347
CVE-2022-28347
GHSA-w24h-v9qh-8gxj
PYSEC-2022-191
Summary A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5498
rhas Important https://access.redhat.com/errata/RHSA-2022:5602
rhas Important https://access.redhat.com/errata/RHSA-2022:5702
rhas Important https://access.redhat.com/errata/RHSA-2022:5703
cvssv3 9.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28347.json
epss 0.00270 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00270 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00279 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00279 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00409 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00414 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00460 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.0063 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00763 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00784 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00831 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.00855 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
epss 0.03792 https://api.first.org/data/v1/epss?cve=CVE-2022-28347
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=2072459
cvssv3.1 7.5 https://docs.djangoproject.com/en/4.0/releases/security
generic_textual HIGH https://docs.djangoproject.com/en/4.0/releases/security
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-w24h-v9qh-8gxj
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 9.8 https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
generic_textual CRITICAL https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
cvssv3.1 9.8 https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
generic_textual CRITICAL https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
cvssv3.1 9.8 https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
generic_textual CRITICAL https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
cvssv3.1 9.8 https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
generic_textual CRITICAL https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
cvssv3.1 9.8 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml
cvssv3.1 3.7 https://groups.google.com/forum/#%21forum/django-announce
generic_textual MODERATE https://groups.google.com/forum/#%21forum/django-announce
cvssv3.1 7.5 https://groups.google.com/forum/#!forum/django-announce
generic_textual HIGH https://groups.google.com/forum/#!forum/django-announce
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-28347
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-28347
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-28347
archlinux High https://security.archlinux.org/AVG-2667
cvssv3.1 8.8 https://www.debian.org/security/2022/dsa-5254
generic_textual HIGH https://www.debian.org/security/2022/dsa-5254
cvssv3.1 9.8 https://www.djangoproject.com/weblog/2022/apr/11/security-releases
generic_textual CRITICAL https://www.djangoproject.com/weblog/2022/apr/11/security-releases
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2022/04/11/1
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2022/04/11/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28347.json
https://api.first.org/data/v1/epss?cve=CVE-2022-28347
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34265
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
https://docs.djangoproject.com/en/4.0/releases/security
https://docs.djangoproject.com/en/4.0/releases/security/
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/django/django
https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml
https://groups.google.com/forum/#%21forum/django-announce
https://groups.google.com/forum/#!forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://www.debian.org/security/2022/dsa-5254
https://www.djangoproject.com/weblog/2022/apr/11/security-releases
https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
http://www.openwall.com/lists/oss-security/2022/04/11/1
1009677 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009677
2072459 https://bugzilla.redhat.com/show_bug.cgi?id=2072459
ASA-202204-9 https://security.archlinux.org/ASA-202204-9
AVG-2667 https://security.archlinux.org/AVG-2667
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2022-28347 https://nvd.nist.gov/vuln/detail/CVE-2022-28347
GHSA-w24h-v9qh-8gxj https://github.com/advisories/GHSA-w24h-v9qh-8gxj
RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498
RHSA-2022:5602 https://access.redhat.com/errata/RHSA-2022:5602
RHSA-2022:5702 https://access.redhat.com/errata/RHSA-2022:5702
RHSA-2022:5703 https://access.redhat.com/errata/RHSA-2022:5703
USN-5373-1 https://usn.ubuntu.com/5373-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28347.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://docs.djangoproject.com/en/4.0/releases/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-191.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://groups.google.com/forum/#%21forum/django-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/forum/#!forum/django-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28347
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28347
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28347
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2022/dsa-5254
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.djangoproject.com/weblog/2022/apr/11/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/04/11/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.67452
EPSS Score 0.00270
Published At Dec. 27, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.