Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/datasette@1.0a4
Typepypi
Namespace
Namedatasette
Version1.0a4
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version1.0.0a21
Latest_non_vulnerable_version1.0.0a21
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-x7hk-zsrw-r7ag
vulnerability_id VCID-x7hk-zsrw-r7ag
summary Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.
references
0
reference_url https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
1
reference_url https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq
2
reference_url https://github.com/advisories/GHSA-7ch3-7pp7-7cpq
reference_id GHSA-7ch3-7pp7-7cpq
reference_type
scores
url https://github.com/advisories/GHSA-7ch3-7pp7-7cpq
fixed_packages
0
url pkg:pypi/datasette@1.0a4
purl pkg:pypi/datasette@1.0a4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/datasette@1.0a4
aliases CVE-2023-40570, GHSA-7ch3-7pp7-7cpq, PYSEC-2023-154
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x7hk-zsrw-r7ag
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/datasette@1.0a4