CVE-2021-3986
Information Disclosure in janeczku/calibre-web
- State
- Published
- Severity
- 4.3 Medium
- Published
- Nov 15, 2024
- Updated
- Nov 15, 2024
- Reserved
- Nov 20, 2021
Description
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | @huntr_ai |
Weaknesses
- CWE-209 Generation of Error Message Containing Sensitive Information
Affected Products
| Product | Versions |
|---|---|
janeczku/calibre-webjaneczku |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.