CVE-2023-40570
2 advisories.
PyPI/datasette CVE-2023-40570: medium 5.3, EPSS 0.56%
Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users
Action: Upgrade datasette to 1.0a4 or later.
pip install datasette==1.0a4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0a0 | 1.0a4 | - |
Fixed versions
| 1.0a4 |
Sources
- osv: GHSA-7ch3-7pp7-7cpq
- https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq
- https://nvd.nist.gov/vuln/detail/CVE-2023-40570
- https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
- https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2023-154.yaml
- https://github.com/simonw/datasette
CVE-2023-40570 · published · modified · JSON
PyPI/datasette CVE-2023-40570: medium 5.3, EPSS 0.56%
Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible lo
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2023-154
- https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq
- https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
CVE-2023-40570 · published · modified · JSON