Lucene search

STAR_LabsCVELIST:CVE-2024-6781

HistoryAug 06, 2024 - 3:38 a.m.

CVE-2024-6781 Calibre Arbitrary File Read

2024-08-0603:38:45

CWE-22

STAR_Labs

www.cve.org

path traversal

calibre

unauthenticated access

arbitrary file read

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.004

Percentile

72.6%

JSON

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Calibre",
    "repo": "https://github.com/kovidgoyal/calibre/",
    "vendor": "Calibre",
    "versions": [
      {
        "status": "affected",
        "version": "7.14.0"
      }
    ]
  }
]

References

github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4

starlabs.sg/advisories/24/24-6781/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.004

Percentile

72.6%

JSON

Related for CVELIST:CVE-2024-6781