Cross-Site Request Forgery in sqlite-web

2021-09-0917:10:35

Google

osv.dev

0.001 Low

EPSS

Percentile

46.8%

JSON

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.

CPENameOperatorVersion
sqlite-webeq0.3.3
sqlite-webeq0.3.0
sqlite-webeq0.1.3
sqlite-webeq0.1.6
sqlite-webeq0.1.1
sqlite-webeq0.1.5
sqlite-webeq0.3.6
sqlite-webeq0.2.2
sqlite-webeq0.3.1
sqlite-webeq0.1.8

Name	Operator	Version
sqlite-web	eq	0.3.3
sqlite-web	eq	0.3.0
sqlite-web	eq	0.1.3
sqlite-web	eq	0.1.6
sqlite-web	eq	0.1.1
sqlite-web	eq	0.1.5
sqlite-web	eq	0.3.6
sqlite-web	eq	0.2.2
sqlite-web	eq	0.3.1
sqlite-web	eq	0.1.8