CVE-2023-40570
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Datasette is an open source tool for exploring and publishing data, which has a vulnerability in versions 1.0 alpha - 1.0a3. The issue involves the disclosure of database and table names at the API explorer endpoint, which may occur if the user is not authenticated.
Risk Assessment
Organizations may be exposed to the disclosure of their database structure, potentially leading to further attacks or unauthorized access to data. The disclosure of database and table names may facilitate attackers in planning their attacks.
Recommendation
It is recommended to upgrade to version 1.0a4, which fixes this vulnerability by blocking access to the API explorer. Additionally, monitor access to JSON APIs to ensure they are not exposed to unauthorized access.
Original NVD description (English source)
Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.