← Back

CVE-2021-3986

nvd nist
Published: Nov 15, 2024Modified: Nov 19, 2024

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.

Affected (1)

Janeczku
1 product
Calibre Web
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Calibre Web
Before 0.6.15

Related CWEs

CWE-209
Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (2)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.