CVE-2024-6781

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6781
Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4 Patch
https://starlabs.sg/advisories/24/24-6781/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*
History

19 Aug 2024, 17:15

Type Values Removed Values Added
References () https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4 - () https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4 - Patch
References () https://starlabs.sg/advisories/24/24-6781/ - () https://starlabs.sg/advisories/24/24-6781/ - Third Party Advisory
CPE cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*
First Time Calibre-ebook calibre
Calibre-ebook

06 Aug 2024, 16:30

Type Values Removed Values Added
Summary
  • (es) El path traversal en Calibre &lt;= 7.14.0 permite a atacantes no autenticados lograr lecturas de archivos arbitrarias.

06 Aug 2024, 04:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-06 04:16

Updated : 2024-08-19 17:15

NVD link : CVE-2024-6781

Mitre link : CVE-2024-6781

CVE.ORG link : CVE-2024-6781

JSON object : View

Products Affected

calibre-ebook

  • calibre
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')