Description

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Remediation

References

CVE-2021-35042

Related Vulnerabilities

Django Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-6188)

WordPress Plugin 2 Click Social Media Buttons 'xing-url' Parameter Cross-Site Scripting (0.32.2)

WordPress Plugin Podcast Channels Cross-Site Scripting (0.20)

Internet Information Services Other Vulnerability (CVE-2002-0072)

WordPress Plugin GD Mail Queue Cross-Site Scripting (3.9.3)

Severity

Critical

Classification

CVE-2021-35042 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities