CVE-2021-3986mediumCWE-209

CVE-2021-3986: medium-severity vulnerability in janeczku/calibre-web

Information Disclosure in janeczku/calibre-web

Published

Follow this CVE+ Monitor janeczku/calibre-web+ Monitor calibreweb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
janeczku · janeczku/calibre-web
Related CVEs — janeczku/calibre-web

In the same product, most dangerous first.

CVE-2021-4171HIGHBusiness Logic Errors in janeczku/calibre-webEPSS 1.4%CVE-2022-0990CRITICALServer-Side Request Forgery (SSRF) in janeczku/calibre-webEPSS 1.3%CVE-2022-0766MEDIUMServer-Side Request Forgery (SSRF) in janeczku/calibre-webEPSS 1.3%CVE-2022-0939CRITICALServer-Side Request Forgery (SSRF) in janeczku/calibre-webEPSS 1.1%CVE-2022-0767CRITICALServer-Side Request Forgery (SSRF) in janeczku/calibre-webEPSS 1.0%CVE-2022-0339MEDIUMServer-Side Request Forgery (SSRF) in janeczku/calibre-webEPSS 1.0%