Homepage

calibreweb@0.6.17 vulnerabilities

Web app for browsing, reading and downloading eBooks stored in a Calibre database.

  • latest version

    0.6.24

  • latest non vulnerable version

    0.6.24

  • first published

    3 years ago

  • latest version published

    5 months ago

  • licenses detected

  • View calibreweb package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the calibreweb package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the edit_book_comments function. An attacker can inject malicious scripts by exploiting the inadequate HTML sanitization performed by the clean_string function.

    How to fix Cross-site Scripting (XSS)?

    Upgrade calibreweb to version 0.6.22 or higher.

    [,0.6.22)
    • H
    Weak Password Requirements

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Weak Password Requirements due to missing rate limits in the login functionality.

    How to fix Weak Password Requirements?

    Upgrade calibreweb to version 0.6.20 or higher.

    [,0.6.20)
    • H
    Brute Force

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Brute Force due to missing rate limiting in login form.

    How to fix Brute Force?

    Upgrade calibreweb to version 0.6.20 or higher.

    [,0.6.20)
    • C
    SQL Injection

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to SQL Injection in the user table.

    How to fix SQL Injection?

    Upgrade calibreweb to version 0.6.18 or higher.

    [,0.6.18)
    • H
    Server-side Request Forgery (SSRF)

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper fix of CVE-2022-0767 and CVE-2022-0766 which only address loopback/localhost IP addresses which can allow attacker to access internal endpoints.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade calibreweb to version 0.6.18 or higher.

    [,0.6.18)
    • C
    Server-side Request Forgery (SSRF)

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper fix CVE-2022-0767, which makes it possible to be bypassed via the IPV4/IPV4 embedding.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade calibreweb to version 0.6.18 or higher.

    [,0.6.18)
    Go back to all versions of this package