CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

• CWE-89

• http://www.openwall.com/lists/oss-security/2020/02/03/1Mailing List, Third Party Advisory
• https://docs.djangoproject.com/en/3.0/releases/security/Vendor Advisory
• https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136Patch, Third Party Advisory
• https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
• https://seclists.org/bugtraq/2020/Feb/30
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20200221-0006/
• https://usn.ubuntu.com/4264-1/
• https://www.debian.org/security/2020/dsa-4629
• https://www.djangoproject.com/weblog/2020/feb/03/security-releases/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2020/02/03/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/02/03/1Mailing List, Third Party Advisory
• https://docs.djangoproject.com/en/3.0/releases/security/Vendor Advisory
• https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136Patch, Third Party Advisory
• https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
• https://seclists.org/bugtraq/2020/Feb/30
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20200221-0006/
• https://usn.ubuntu.com/4264-1/
• https://www.debian.org/security/2020/dsa-4629
• https://www.djangoproject.com/weblog/2020/feb/03/security-releases/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2020/02/03/1Mailing List, Third Party Advisory

Published

Feb 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7465The L2TP implementation of MPD before 5.9 allows a remote at…9.8
• CVE-2020-7466The PPP implementation of MPD before 5.9 allows a remote att…7.5
• CVE-2020-7467In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r3…7.6
• CVE-2020-7468In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r3…8.8
• CVE-2020-7469In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r3…7.5
• CVE-2020-7470Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XS…4.8
• CVE-2020-7472An authorization bypass and PHP local-file-include vulnerabi…9.8
• CVE-2020-7473In certain situations, all versions of Citrix ShareFile Stor…7.5
• CVE-2020-7474A CWE-427: Uncontrolled Search Path Element vulnerability ex…7.8
• CVE-2020-7475A CWE-74: Improper Neutralization of Special Elements in Out…9.8
• CVE-2020-7476A CWE-426: Untrusted Search Path vulnerability exists in Zig…7.8
• CVE-2020-7477A CWE-754: Improper Check for Unusual or Exceptional Conditi…7.5