CVE-2021-30459

A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
VendorProductVersion
jazzbanddjango_debug_toolbar
0.10.0 ≤
𝑥
< 1.11.1
jazzbanddjango_debug_toolbar
2.0.0 ≤
𝑥
< 2.2.1
jazzbanddjango_debug_toolbar
3.0.0 ≤
𝑥
< 3.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jazzband/django-debug-toolbar/releases
https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
https://github.com/jazzband/django-debug-toolbar/releases
https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/