CVE-2023-40570

MEDIUM

Datasette 1.0a0-1.0a3 - Unauthenticated Sensitive Information Exposure via API Explorer Endpoint

Title source: llm
STIX 2.1

Description

Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0046
EPSS Percentile 37.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-213
Status published
Products (2)
datasette/datasette 1.0 alpha0 (4 CPE variants)
pypi/datasette 1.0a0 - 1.0a4PyPI
Published Aug 25, 2023
Tracked Since Feb 18, 2026