Описание
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Ссылки
- PatchVendor Advisory
- Third Party Advisory
- PatchVendor Advisory
- Mailing ListPatchThird Party Advisory
- PatchVendor Advisory
- Third Party Advisory
- PatchVendor Advisory
- Mailing ListPatchThird Party Advisory
Уязвимые конфигурации
Одно из
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orde ...
Уязвимость функции QuerySet.order_by() программной платформы для веб-приложений Django, позволяющая нарушителю выполнить произвольные команды
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2