Unauthorized Actions via Public Shelf Creation in Calibre-Web
CVE-2021-3987

4.3MEDIUM

Key Information:

Vendor
Janeczku
Status
Janeczku/calibre-web
Vendor
CVE Published:
15 November 2024

Summary

An access control vulnerability in Janeczku's Calibre-Web application permits users lacking the required public shelf permissions to create public shelves. The issue arises from the 'create_shelf' method within 'shelf.py', which fails to validate user permissions effectively. As a result, this oversight could allow unauthorized users to perform actions intended for permitted users, posing a security risk to the integrity of user data and shelf management.

Affected Version(s)

janeczku/calibre-web <= unspecified

References

https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec...
https://github.com/janeczku/calibre-web/commit/bcdc976414...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.