GitHub Advisoryadvisory · PyPI

GHSA-h65g-jfqg-2w6m Server-Side Request Forgery in calibreweb

CRITICAL Published 2022-03-08 Modified 2026-10-27 Official page ↗
Aliases
CVE-2022-0767
Ecosystem
PyPI
Packages
calibreweb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
Weaknesses
CWE-918
Reviewed
2022-03-08

Affected packages

• PyPI calibreweb: < 0.6.17 → fixed in 0.6.17

Description

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.

Related

Alias · CVE (1)

  • CVE-2022-0767 Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References