PT-2021-15495 · Unknown · Sqlite-Web

Yadhu Krishna M · Published 2021-09-08 · Updated 2021-09-14 · CVE-2021-23404

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions sqlite-web versions (all versions)

Description The issue concerns a lack of validation for requests in the SQL dashboard area, allowing sensitive actions to be performed without proper verification of the request's origin. This could enable an attacker to trick a user into performing unintended actions through a Cross Site Request Forgery (CSRF) attack.

Recommendations For all versions, consider implementing proper request validation to ensure that actions in the SQL dashboard area originate from the application, mitigating the risk of CSRF attacks. As a temporary workaround, restrict access to the SQL dashboard area to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-23404

GHSA-2J58-PWWV-X666

PYSEC-2021-332

SNYK-PYTHON-SQLITEWEB-1316324

Affected Products

Sqlite-Web

References · 11

• 🔥 https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23404 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23404 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j58-pwwv-x666 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-332 · Vendor Advisory
• https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1 · Note
• https://github.com/coleifer/sqlite-web/blob/4ba53979eb342c69fb3b7a75eeed43da7a3d3822/sqlite_web/sqlite_web.py#L1338 · Note
• https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py · Note
• https://github.com/coleifer/sqlite-web · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sqlite-web/PYSEC-2021-332.yaml · Note
• https://github.com/advisories/GHSA-2j58-pwwv-x666 · Note