Moderate severityNVD Advisory· Published Nov 15, 2024· Updated Nov 15, 2024

Improper Access Control in janeczku/calibre-web

CVE-2021-3987

Description

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the create_shelf method in shelf.py not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
calibrewebPyPI	< 0.6.15	0.6.15

Affected products

ghsa-coords
pkg:pypi/calibreweb
Range: < 0.6.15
Janeczku/Calibre Webcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fj5v-w2jp-wqvjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-3987ghsaADVISORY
github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874ghsaWEB
huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71dfghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000