Vulnerability Details CVE-2021-25965
In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.5%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- https://github.com/janeczku/calibre-web/commit/50919d47212066c75f03ee7a5332ecf2d584b98e
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25965
- https://github.com/janeczku/calibre-web/commit/50919d47212066c75f03ee7a5332ecf2d584b98e
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25965
Products affected by CVE-2021-25965
-
cpe:2.3:a:janeczku:calibre-web:0.6.0
-
cpe:2.3:a:janeczku:calibre-web:0.6.10
-
cpe:2.3:a:janeczku:calibre-web:0.6.11
-
cpe:2.3:a:janeczku:calibre-web:0.6.12
-
cpe:2.3:a:janeczku:calibre-web:0.6.13
-
cpe:2.3:a:janeczku:calibre-web:0.6.2
-
cpe:2.3:a:janeczku:calibre-web:0.6.3
-
cpe:2.3:a:janeczku:calibre-web:0.6.4
-
cpe:2.3:a:janeczku:calibre-web:0.6.5
-
cpe:2.3:a:janeczku:calibre-web:0.6.6
-
cpe:2.3:a:janeczku:calibre-web:0.6.7
-
cpe:2.3:a:janeczku:calibre-web:0.6.8
-
cpe:2.3:a:janeczku:calibre-web:0.6.9