{"id":"CVE-2022-0767","published":"2022-03-07T07:05:11Z","modified":"2024-08-02T23:40:03Z","title":"Server-Side Request Forgery (SSRF) in janeczku/calibre-web","vendor":"janeczku","product":"janeczku/calibre-web","tier":"tail","description":{"text":"Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00985,"percentile":0.6229,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://huntr.dev/bounties/b26fc127-9b6a-4be7-a455-58aefbb62d9e","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8","tags":["x_refsource_MISC"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":12.46},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"janeczku","affectedVersions":[{"vendor":"janeczku","product":"janeczku/calibre-web","versions":[">= unspecified, < 0.6.17"]}],"affected":[{"ecosystem":"PyPI","package":"calibreweb","vulnerableRanges":["<0.6.17"],"patched":["0.6.17"],"from":["GHSA-h65g-jfqg-2w6m","PYSEC-2026-306"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1437","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-janeczku-calibre-web-cve-2022-0339","parents":[{"from":"CVE-2022-0339","to":"CVE-2022-0767","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:calibreweb","fromFixed":"0.6.16","toFixed":"0.6.17","daysApart":36},{"kind":"same-code","provenance":"machine","files":["cps/helper.py"],"commits":["https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92","https://github.com/janeczku/calibre-web/commit/35f6f4c727c887f8f3607fe3233dbc1980d15020","https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2022-0339","published":"2022-01-30","fixed":"0.6.16","kev":false},{"cve":"CVE-2022-0352","published":"2022-01-28","fixed":"0.6.16","kev":false},{"cve":"CVE-2022-0766","published":"2022-03-07","fixed":"0.6.17","kev":false},{"cve":"CVE-2022-0767","published":"2022-03-07","fixed":"0.6.17","kev":false},{"cve":"CVE-2022-30765","published":"2022-05-16","fixed":"0.6.18","kev":false},{"cve":"CVE-2022-2525","published":"2023-04-15","fixed":"0.6.20","kev":false},{"cve":"CVE-2023-2106","published":"2023-04-15","fixed":"0.6.20","kev":false}],"package":"PyPI:calibreweb"}}