Critical severity · published Apr 14, 2021
CVE-2021-30459
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by…
9.8
CVSS
1.9%
EPSS
No
On KEV
Description
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Django Debug Toolbar · Jazzband
0.10.0 before 1.11.1; 2.0.0 before 2.2.1; 3.0.0 before 3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-30459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-30459
Third Party Advisory
https://github.com/jazzband/django-debug-toolbar/releases
Patch
https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj
Vendor Advisory
https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/