GitHub Advisoryadvisory · PyPI

GHSA-fj5v-w2jp-wqvj Improper Access Control in janeczku/calibre-web

MEDIUM Published 2024-11-15 Modified 2024-11-15 Official page ↗
Aliases
CVE-2021-3987
Ecosystem
PyPI
Packages
calibreweb
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284, CWE-862
Reviewed
2024-11-15

Affected packages

• PyPI calibreweb: < 0.6.15 → fixed in 0.6.15

Description

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

Related

Alias · CVE (1)

  • CVE-2021-3987 An improper access control vulnerability exists in janeczku/calibre-web. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-862 Missing Authorization weakness

References