CVE-2025-13372
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-12
Assigner: Django Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| djangoproject | django | From 4.2 (inc) to 4.2.27 (exc) |
| djangoproject | django | From 5.1 (inc) to 5.1.15 (exc) |
| djangoproject | django | From 5.2 (inc) to 5.2.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue in Django's FilteredRelation feature affecting versions before 5.2.9, 5.1.15, and 4.2.27. It occurs when column aliases are created using a specially crafted dictionary passed as keyword arguments to QuerySet.annotate() or QuerySet.alias() on PostgreSQL databases, allowing an attacker to inject malicious SQL code.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform SQL injection attacks, potentially leading to unauthorized access to or manipulation of database data. However, the CVSS score indicates a low severity impact with limited confidentiality impact and no integrity or availability impact, requiring network access and user interaction.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Django to a fixed version: 5.2.9 or later, 5.1.15 or later, or 4.2.27 or later. Avoid using unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x which may also be affected.