PT-2024-5692 · Calibre+1 · Calibre+1

Amos Ng + 1 · Published 2024-07-31 · Updated 2025-02-12 · CVE-2024-6782

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Calibre versions 6.9.0 through 7.14.0

Description The issue is related to improper access control in the software, which allows unauthenticated attackers to achieve remote code execution. This is due to a vulnerability associated with deficiencies in the authorization mechanism. The exploitation of this vulnerability can enable a remote attacker to execute arbitrary code.

Recommendations For Calibre versions 6.9.0 through 7.14.0, consider disabling the Content Server component as a temporary workaround until a patch is available. Restrict access to the Content Server component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2024-13656

BDU:2024-06405

CVE-2024-6782

MGASA-2025-0049

Affected Products

Alt Linux

Calibre

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/calibre_exec.rb · Exploit
• 🔥 https://github.com/zangjiahe/CVE-2024-6782 · Exploit
• https://github.com/kovidgoyal/calibre/commit/38a1bf50d8cd22052ae59c513816706c6445d5e9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-6782 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6782 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6782 · Security Note
• https://ubuntu.com/security/CVE-2024-6782 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PTG4W7NKCI3YSS24S3XTWQKFDUAR6BN3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6782 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-08-05.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6782 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-6782 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0049 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06405 · Security Note
• https://advisories.mageia.org/MGASA-2025-0049.html · Security Note