CVE-2022-0406 - OpenCVE

Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Calibre-web Project	Calibre-web

Configuration 1 [-]

cpe:2.3:a:calibre-web_project:calibre-web:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706
https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-04-03T19:05:10

Updated: 2024-08-02T23:25:40.441Z

Reserved: 2022-01-28T00:00:00

Link: CVE-2022-0406

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-04-03T19:15:07.880

Modified: 2022-04-09T15:52:49.447

Link: CVE-2022-0406

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "janeczku/calibre-web", "vendor": "janeczku", "versions": [{"lessThan": "0.6.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-03T19:05:10", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706"}], "source": {"advisory": "d7498799-4797-4751-b5e2-b669e729d5db", "discovery": "EXTERNAL"}, "title": "Improper Authorization in janeczku/calibre-web", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-0406", "STATE": "PUBLIC", "TITLE": "Improper Authorization in janeczku/calibre-web"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "janeczku/calibre-web", "version": {"version_data": [{"version_affected": "<", "version_value": "0.6.16"}]}}]}, "vendor_name": "janeczku"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-285 Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db"}, {"name": "https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706", "refsource": "MISC", "url": "https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706"}]}, "source": {"advisory": "d7498799-4797-4751-b5e2-b669e729d5db", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:25:40.441Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-0406", "datePublished": "2022-04-03T19:05:10", "dateReserved": "2022-01-28T00:00:00", "dateUpdated": "2024-08-02T23:25:40.441Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:calibre-web_project:calibre-web:*:*:*:*:*:*:*:*", "matchCriteriaId": "617B843B-6C45-4C15-B38C-03A1E9052D91", "versionEndExcluding": "0.6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16."}, {"lang": "es", "value": "Una Autorizaci\u00f3n Inapropiada en el repositorio de GitHub janeczku/calibre-web versiones anteriores a 0.6.16"}], "id": "CVE-2022-0406", "lastModified": "2022-04-09T15:52:49.447", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-03T19:15:07.880", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@huntr.dev", "type": "Secondary"}]}