{"id":"CVE-2022-0339","published":"2022-01-30T13:17:54Z","modified":"2024-08-02T23:25:40Z","title":"Server-Side Request Forgery (SSRF) in janeczku/calibre-web","vendor":"janeczku","product":"janeczku/calibre-web","tier":"tail","description":{"text":"Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00962,"percentile":0.6155,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92","tags":["x_refsource_MISC"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":12.31},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"janeczku","affectedVersions":[{"vendor":"janeczku","product":"janeczku/calibre-web","versions":[">= unspecified, < 0.6.16"]}],"affected":[{"ecosystem":"PyPI","package":"calibreweb","vulnerableRanges":["<0.6.16"],"patched":["0.6.16"],"from":["GHSA-4w8p-x6g8-fv64","PYSEC-2022-23"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0035","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-janeczku-calibre-web-cve-2022-0339","children":[{"from":"CVE-2022-0339","to":"CVE-2022-0766","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:calibreweb","fromFixed":"0.6.16","toFixed":"0.6.17","daysApart":36},{"kind":"same-code","provenance":"machine","files":["cps/helper.py"],"commits":["https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92","https://github.com/janeczku/calibre-web/commit/35f6f4c727c887f8f3607fe3233dbc1980d15020","https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2022-0339","to":"CVE-2022-0767","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:calibreweb","fromFixed":"0.6.16","toFixed":"0.6.17","daysApart":36},{"kind":"same-code","provenance":"machine","files":["cps/helper.py"],"commits":["https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92","https://github.com/janeczku/calibre-web/commit/35f6f4c727c887f8f3607fe3233dbc1980d15020","https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2021-4170","published":"2022-01-16","fixed":"0.6.15","kev":false},{"cve":"CVE-2021-4171","published":"2022-01-17","fixed":"0.6.15","kev":false},{"cve":"CVE-2022-0273","published":"2022-01-30","fixed":"0.6.16","kev":false},{"cve":"CVE-2022-0339","published":"2022-01-30","fixed":"0.6.16","kev":false},{"cve":"CVE-2022-0352","published":"2022-01-28","fixed":"0.6.16","kev":false},{"cve":"CVE-2022-0766","published":"2022-03-07","fixed":"0.6.17","kev":false},{"cve":"CVE-2022-0767","published":"2022-03-07","fixed":"0.6.17","kev":false}],"package":"PyPI:calibreweb"}}