PT-2024-11003 · Janeczku · Calibre-Web

Published 2024-11-15 · Updated 2024-11-19 · CVE-2021-3986

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions janeczku/calibre-web versions prior to the fix

Description A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information.

Recommendations Update to the latest release to mitigate risks. As a temporary workaround, consider modifying the shelf.py file to prevent the exposure of private shelf names in error messages. Restrict access to the shelf.py file to minimize the risk of exploitation.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2021-3986

GHSA-M982-H4F8-G4HF

Affected Products

Calibre-Web

References · 10

• 🔥 https://huntr.com/bounties/394af194-61a7-4e33-b373-877d4c766fca · Exploit
• https://github.com/janeczku/calibre-web/commit/6f5390ead5df9779ac81fadefffb476e03f93548 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3986 · Security Note
• https://osv.dev/vulnerability/GHSA-m982-h4f8-g4hf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3986 · Vendor Advisory
• https://github.com/janeczku/calibre-web · Note
• https://t.me/cvedetector/11069 · Telegram Post
• https://twitter.com/transilienceai/status/1857654750486970549 · Twitter Post
• https://twitter.com/transilienceai/status/1857654756551848103 · Twitter Post
• https://twitter.com/CVEnew/status/1857381730191278379 · Twitter Post