GitHub Advisoryadvisory · PyPI

GHSA-2647-c639-qv2j Server-Side Request Forgery in calibreweb

CRITICAL Published 2022-03-08 Modified 2026-10-27 Official page ↗
Aliases
CVE-2022-0766
Ecosystem
PyPI
Packages
calibreweb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2022-03-08

Affected packages

• PyPI calibreweb: < 0.6.17 → fixed in 0.6.17

Description

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is due to an incomplete fix for CVE-2022-0339. The blacklist does not check for `0.0.0.0`, which would result in a payload of `0.0.0.0` resolving to `localhost`.

Related

Alias · CVE (1)

  • CVE-2022-0766 Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References