{"id":"CVE-2021-23404","aliases":["EUVD-2021-0249","GHSA-2j58-pwwv-x666","PYSEC-2021-332","SNYK-PYTHON-SQLITEWEB-1316324"],"status":"published","title":"Cross-site Request Forgery (CSRF)","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:R","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00477,"percentile":0.41726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2021-09-08T10:50:10Z","modified":"2026-06-17T03:38:42Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sqlite-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"sqlite-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.5"}]}],"versions":["0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5"]},{"source":"osv","ecosystem":"PyPI","package":"sqlite-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4"]}],"products":[{"vendor":"sqlite-web_project","product":"sqlite-web"}],"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","advisory"]},{"url":"https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23404","tags":["advisory"]},{"url":"https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/sqlite-web/PYSEC-2021-332.yaml","tags":["web"]},{"url":"https://github.com/coleifer/sqlite-web/blob/4ba53979eb342c69fb3b7a75eeed43da7a3d3822/sqlite_web/sqlite_web.py#L1338","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2j58-pwwv-x666","tags":["advisory"]},{"url":"https://github.com/coleifer/sqlite-web","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-23404","title":"Cross-site Request Forgery (CSRF)","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-08T10:50:10.067Z","modified":"2024-09-16T18:29:23.999Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:R","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-0249","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-08T10:50:10Z","modified":"2024-09-16T18:29:23Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:R","level":"high"}],"updated_at":"2026-11-03T00:55:32.095421Z"}],"ghsa":[{"id":"GHSA-2j58-pwwv-x666","title":"Cross-Site Request Forgery in sqlite-web","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-09T17:10:35Z","modified":"2025-11-27T09:16:05Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:F","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2021-23404","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-08T11:15:07.337Z","modified":"2026-06-17T03:38:42.037Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:58.05696Z"}],"osv":[{"id":"GHSA-2j58-pwwv-x666","title":"Cross-Site Request Forgery in sqlite-web","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-09T17:10:35Z","modified":"2025-11-27T09:33:45.567353Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:F","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"PYSEC-2021-332","description":"This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.","status":"published","published":"2021-09-08T11:15:00Z","modified":"2025-10-09T07:34:55.397394Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}