calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost.
GSA_kwCzR0hTQS1oNjVnLWpmcWctMnc2bc0wtg
Server-Side Request Forgery in calibreweb
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| pypi:calibreweb | < 0.6.17 | 0.6.17 | |
Affected Version RangesAll affected versions0.6.12, 0.6.13, 0.6.14, 0.6.15, 0.6.16 All unaffected versions0.6.17, 0.6.18, 0.6.19, 0.6.20, 0.6.21, 0.6.22, 0.6.23, 0.6.24 |
|||