CVEvulnerability
CVE-2021-30459
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-04-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
Affected configurations
• jazzband django debug toolbar (>= 0.10.0 < 1.11.1)
• jazzband django debug toolbar (>= 2.0.0 < 2.2.1)
• jazzband django debug toolbar (>= 3.0.0 < 3.2.1)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/jazzband/django-debug-toolbar/releases Third Party Advisory
- https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj Patch, Third Party Advisory
- https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/ Vendor Advisory
- https://github.com/jazzband/django-debug-toolbar/releases Third Party Advisory
- https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj Patch, Third Party Advisory
- https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/ Vendor Advisory