CVE-2021-32670
Summary
| CVE | CVE-2021-32670 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-06-07 22:15:00 UTC |
| Updated | 2021-06-14 16:28:00 UTC |
| Description | Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cross Site Scripting (XSS) Software Attack | OWASP Foundation | MISC | owasp.org | |
| Reflected cross-site scripting issue in Datasette · Advisory · simonw/datasette · GitHub | CONFIRM | github.com | |
| datasette · PyPI | MISC | pypi.org | |
| datasette-auth-passwords - a plugin for Datasette | MISC | datasette.io | |
| Security flaw, to be fixed in 0.56.1 and 0.57 · Issue #1360 · simonw/datasette · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982330 Python (pip) Security Update for datasette (GHSA-gff3-739c-gxfq)