CVE-2021-23404: Cross-Site Request Forgery in sqlite-web
(updated )
This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
References
- github.com/advisories/GHSA-2j58-pwwv-x666
- github.com/coleifer/sqlite-web
- github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py
- github.com/coleifer/sqlite-web/blob/4ba53979eb342c69fb3b7a75eeed43da7a3d3822/sqlite_web/sqlite_web.py
- github.com/pypa/advisory-database/tree/main/vulns/sqlite-web/PYSEC-2021-332.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-23404
- snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324
Code Behaviors & Features
Detect and mitigate CVE-2021-23404 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →