~ / search / GHSA-h65g-jfqg-2w6m

GHSA-h65g-jfqg-2w6m

Server-Side Request Forgery in calibreweb

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-0767

Packages

EcosystemPackageAffectedFixed in
PyPI calibreweb < 0.6.17 0.6.17

Details

As written in the advisory (Markdown source, shown as plain text).

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.

References

External links from the advisory. They lead to third-party sites.