WS-2020-0141

The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitting the...

Information Disclosure

datasette is vulnerable to information disclosure. The vulnerability exists as Cross-Site Request Forgery CRSF tokens are leaked through read-only canned queries...

CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

GHSA-Q6J3-C4WC-63VW CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

PT-2020-21453

Name of the Vulnerable Software and Affected Versions Datasette versions prior to 0.46 Description The HTML form for a read-only canned query in Datasette includes a hidden CSRF token field. When this form is submitted, the CSRF token is exposed in the URL. For example, submitting the form on...