CVE-2021-3986CWE-209

Information Disclosure in janeczku/calibre-web

Medium · published November 15, 2024

CVSS v3.0
4.3
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.8th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2024-11-15T10:52Z
EPSS history
Timeline
  • 15 NOV 10:52Z
    Information Disclosure in janeczku/calibre-web
    cvelistv5