Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

sqlpage

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0crates.ioPublished

    SQLpage vulnerable to public exposure of database credentials

    CVE-2023-42454 · GHSA-v5wf-jg37-r9m5

    Affected
    • crates.io sqlpage < 0.11.1
    Fixed in
    0.11.1· Vendor fix available
    Issue
    Impact If - you are using a SQLPage version older than v0.11.1 - your SQLPage instance is exposed publicly - the database connection string is specified in the sqlpage/sqlpage.json configuration file (not in an environment variable) - the webroot is the current working directory (the default) - your database is exposed publicly then an attacker could retrieve the database connection information from SQLPage and use it to connect to your database directly. Patches Upgrade to v0.11.1 as soon as possible. Workarounds If you cannot upgrade immediately: - Using an environment variable instead of the configuration file to specify the database connection string prevents exposing it on vulnerable versions. - Using a different web root (that is not a parent of the SQLPage configuration directory) fixes the issue. - And in any case, you should generally avoid exposing your database publicly References https://github.com/lovasoa/SQLpage/issues/89

    Recommended action: Upgrade to 0.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →