Search for vulnerabilities
Vulnerability details: VCID-rn9g-dan7-aaap
Vulnerability ID VCID-rn9g-dan7-aaap
Aliases BIT-2022-28346
BIT-django-2022-28346
CVE-2022-28346
GHSA-2gwj-7jmv-h26r
PYSEC-2022-190
Summary An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5115
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5498
rhas Important https://access.redhat.com/errata/RHSA-2022:5602
rhas Important https://access.redhat.com/errata/RHSA-2022:5702
rhas Important https://access.redhat.com/errata/RHSA-2022:5703
cvssv3 9.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28346.json
epss 0.00304 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00308 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00371 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00371 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00379 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.00379 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02146 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02168 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02413 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02478 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02502 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02672 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02744 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
epss 0.02744 https://api.first.org/data/v1/epss?cve=CVE-2022-28346
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=2072447
cvssv3.1 7.5 https://docs.djangoproject.com/en/4.0/releases/security
generic_textual HIGH https://docs.djangoproject.com/en/4.0/releases/security
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-2gwj-7jmv-h26r
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 9.8 https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
generic_textual CRITICAL https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
cvssv3.1 9.8 https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
generic_textual CRITICAL https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
cvssv3.1 9.8 https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
generic_textual CRITICAL https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
cvssv3.1 9.8 https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
generic_textual CRITICAL https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
cvssv3.1 9.8 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
cvssv3.1 3.7 https://groups.google.com/forum/#%21forum/django-announce
generic_textual MODERATE https://groups.google.com/forum/#%21forum/django-announce
cvssv3.1 7.5 https://groups.google.com/forum/#!forum/django-announce
generic_textual HIGH https://groups.google.com/forum/#!forum/django-announce
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-28346
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-28346
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-28346
archlinux High https://security.archlinux.org/AVG-2667
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20220609-0002
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20220609-0002
cvssv3.1 8.8 https://www.debian.org/security/2022/dsa-5254
generic_textual HIGH https://www.debian.org/security/2022/dsa-5254
cvssv3.1 9.8 https://www.djangoproject.com/weblog/2022/apr/11/security-releases
generic_textual CRITICAL https://www.djangoproject.com/weblog/2022/apr/11/security-releases
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2022/04/11/1
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2022/04/11/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28346.json
https://api.first.org/data/v1/epss?cve=CVE-2022-28346
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34265
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
https://docs.djangoproject.com/en/4.0/releases/security
https://docs.djangoproject.com/en/4.0/releases/security/
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/django/django
https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
https://groups.google.com/forum/#%21forum/django-announce
https://groups.google.com/forum/#!forum/django-announce
https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://security.netapp.com/advisory/ntap-20220609-0002
https://security.netapp.com/advisory/ntap-20220609-0002/
https://www.debian.org/security/2022/dsa-5254
https://www.djangoproject.com/weblog/2022/apr/11/security-releases
https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
http://www.openwall.com/lists/oss-security/2022/04/11/1
1009677 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009677
2072447 https://bugzilla.redhat.com/show_bug.cgi?id=2072447
ASA-202204-9 https://security.archlinux.org/ASA-202204-9
AVG-2667 https://security.archlinux.org/AVG-2667
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2022-28346 https://nvd.nist.gov/vuln/detail/CVE-2022-28346
GHSA-2gwj-7jmv-h26r https://github.com/advisories/GHSA-2gwj-7jmv-h26r
RHSA-2022:5115 https://access.redhat.com/errata/RHSA-2022:5115
RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498
RHSA-2022:5602 https://access.redhat.com/errata/RHSA-2022:5602
RHSA-2022:5702 https://access.redhat.com/errata/RHSA-2022:5702
RHSA-2022:5703 https://access.redhat.com/errata/RHSA-2022:5703
RHSA-2022:8872 https://access.redhat.com/errata/RHSA-2022:8872
USN-5373-1 https://usn.ubuntu.com/5373-1/
USN-5373-2 https://usn.ubuntu.com/5373-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28346.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://docs.djangoproject.com/en/4.0/releases/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://groups.google.com/forum/#%21forum/django-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/forum/#!forum/django-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28346
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28346
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-28346
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20220609-0002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2022/dsa-5254
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.djangoproject.com/weblog/2022/apr/11/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/04/11/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.70195
EPSS Score 0.00304
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.