CVE-2021-35042: SQL Injection
Published Jul 2, 2021
·Updated
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application.
Affected Software
5 affected componentsFixes available
pip/Django>=3.0a1<3.1.13
3.1.13
pip/Django>=3.2a1<3.2.5
3.2.5
djangoproject Django>=3.1<3.1.13
djangoproject Django>=3.2<3.2.5
Fedoraproject Fedora=34
Remediation
Patch Available
Patch Available
Event History
Jul 2, 2021
CVE Published
via MITRE·09:54 AM
Data Sourced
via MITRE·09:54 AM
Description
Sep 22, 2021
Advisory Published
via GitHub·05:34 PM
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-35042.
2
What is the severity of CVE-2021-35042?
The severity of CVE-2021-35042 is critical with a CVSS score of 9.8.
3
Which versions of Django are affected by CVE-2021-35042?
Django versions 3.1.x before 3.1.13 and 3.2.x before 3.2.5 are affected by CVE-2021-35042.
4
What is the impact of CVE-2021-35042?
CVE-2021-35042 allows SQL injection if untrusted input is used in the order_by parameter of QuerySet.order_by in a web application.
5
How can I fix CVE-2021-35042?
To fix CVE-2021-35042, upgrade Django to version 3.1.13 or 3.2.5, depending on the installed version.