GitHub Advisoryadvisory · PyPI

GHSA-xpfp-f569-q3p2 SQL Injection in Django

CRITICAL Published 2021-09-22 Modified 2024-09-20 Official page ↗
Aliases
CVE-2021-35042
Ecosystem
PyPI
Packages
Django
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-07-03

Affected packages

• PyPI Django: >= 3.2a1, < 3.2.5 → fixed in 3.2.5 • PyPI Django: >= 3.0a1, < 3.1.13 → fixed in 3.1.13

Description

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Related

Alias · CVE (1)

  • CVE-2021-35042 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References