id: PYSEC-2021-332
details: This affects all versions of package sqlite-web. The SQL dashboard area allows
  sensitive actions to be performed without validating that the request originated
  from the application. This could enable an attacker to trick a user into performing
  these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
affected:
- package:
    name: sqlite-web
    ecosystem: PyPI
    purl: pkg:pypi/sqlite-web
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
  versions:
  - 0.1.1
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
  - 0.3.8
  - 0.3.9
  - 0.4.0
references:
- type: WEB
  url: https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1
- type: ADVISORY
  url: https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324
- type: ADVISORY
  url: https://github.com/advisories/GHSA-2j58-pwwv-x666
aliases:
- CVE-2021-23404
- SNYK-PYTHON-SQLITEWEB-1316324
- GHSA-2j58-pwwv-x666
modified: '2021-10-14T13:17:51.118876Z'
published: '2021-09-08T11:15:00Z'