PT-2021-18736 · Django · Django Debug Toolbar

Jezdez · Published 2021-04-14 · Updated 2024-07-12 · CVE-2021-30459

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Django Debug Toolbar versions 1.x through 1.11.0 Django Debug Toolbar versions 2.x through 2.2.0 Django Debug Toolbar versions 3.x through 3.2.0

Description A SQL Injection issue in the SQL Panel allows attackers to execute SQL statements by changing the raw sql input field of the SQL explain, analyze, or select form. This is a high severity issue for anyone using the toolbar in a production environment.

Recommendations For Django Debug Toolbar version 1.x, upgrade to version 1.11.1. For Django Debug Toolbar version 2.x, upgrade to version 2.2.1. For Django Debug Toolbar version 3.x, upgrade to version 3.2.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-30459

GHSA-PGHF-347X-C2GJ

OPENSUSE-SU-2024:11225-1

OPENSUSE-SU-2024:14137-1

PYSEC-2021-10

Affected Products

Django Debug Toolbar

References · 12

• https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30459 · Security Note
• https://osv.dev/vulnerability/GHSA-pghf-347x-c2gj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-10 · Vendor Advisory
• https://djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30459 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14137-1 · Vendor Advisory
• https://github.com/jazzband/django-debug-toolbar/releases · Note
• https://github.com/jazzband/django-debug-toolbar · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-debug-toolbar/PYSEC-2021-10.yaml · Note
• https://suse.com/security/cve/CVE-2021-30459 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30459 · Note