Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w

Summary

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Timeline

1. Jul 2, 2021, 9:54 AM UTCCVE published
2. Aug 4, 2024, 12:33 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• djangoPyPI

  From 3.1 · fixed in 3.1.13; From 3.2 · fixed in 3.2.5

• djangoPyPI

  From 3.2a1 · fixed in 3.2.5

• djangoPyPI

  From 3.0a1 · fixed in 3.1.13

References 12