2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"product":"janeczku/calibre-web","vendor":"janeczku","versions":[{"lessThanOrEqual":"latest","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"},{"affectedData":[{"cpes":["cpe:2.3:a:calibre-web_project:calibre-web:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"calibre-web","vendor":"calibre-web_project","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*","matchCriteriaId":"CB86DF8E-5F67-41CA-B657-D8E0A61CD22A","versionEndExcluding":"0.6.15","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users."},{"lang":"es","value":"Existe una vulnerabilidad de control de acceso indebido en janeczku/calibre-web. La versión afectada permite a los usuarios sin permisos de estantería pública crear estanterías públicas. La vulnerabilidad se debe a que el método `create_shelf` en `shelf.py` no verifica si el usuario tiene los permisos necesarios para crear una estantería pública. Este problema puede provocar que los usuarios realicen acciones no autorizadas."}],"id":"CVE-2021-3987","lastModified":"2026-06-17T04:06:20.773","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security@huntr.dev","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-3987","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-15T18:27:02.281125Z","version":"2.0.3"}}]},"published":"2024-11-15T11:15:06.610","references":[{"source":"security@huntr.dev","tags":["Patch"],"url":"https://github.com/janeczku/calibre-web/commit/bcdc97641447965af486964537f3821f47b28874"},{"source":"security@huntr.dev","tags":["Exploit"],"url":"https://huntr.com/bounties/29fcc091-87b6-43bc-ab4b-3c0bec3f71df"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@huntr.dev","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
|