Ozzieisaacs

**Name of the Vulnerable Software and Affected Versions** calibre-web versions prior to 0.6.17 **Description** The issue is related to Server-Side Request Forgery (SSRF) in the GitHub repository janeczku/calibre-web. This is due to an incomplete fix, which results in the blacklist not checking for `0.0.0.0`, allowing a payload of `0.0.0.0` to resolve to `localhost`. **Recommendations** For versions prior to 0.6.17, update to version 0.6.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the `localhost` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** calibreweb versions prior to 0.6.16 **Description** The issue is related to Cross-site Scripting (XSS) - Reflected, which means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take control of the user's session. This type of attack occurs when user input is not properly validated or sanitized, and an attacker can reflect their input back to the user, executing the malicious script. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 0.6.16, update to version 0.6.16 or later to resolve the issue. As a temporary workaround, consider implementing input validation and sanitization for all user-input data to minimize the risk of exploitation. Restrict access to sensitive areas of the application to minimize the risk of XSS attacks until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Calibre-web versions 0.6.0 through 0.6.13 **Description** The issue allows an attacker to create a new user role with admin privileges and attacker-controlled credentials by luring an authenticated user to click on a link, potentially taking over the application. This is achieved through Cross-Site Request Forgery (CSRF). **Recommendations** For Calibre-web versions 0.6.0 through 0.6.13, as a temporary workaround, consider restricting access to user role creation functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.