CVE-2021-3986: Information Disclosure in janeczku/calibre-web

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Generation of Error Message Containing Sensitive Information in janeczku/calibre-web - Report Date: Nov 15th 2021 - Vulnerability Type: CWE-209: Generation of Error Message Containing Sensitive Information - Description: When a user attempts to delete a book from another user’s private shelf, the name of the other user’s shelf becomes visible. 2. Vulnerability Impact: - Impact: Leakage of sensitive information belonging to unauthorized users, which should not be disclosed. 3. Reproduction Steps: - Step 1: As an administrator, create a shelf with shelf ID 1. - Step 2: Add a book to this shelf with book ID 2. - Step 3: Log in as a different user and send the following request: GET /shelf/remove/1/2. - Step 4: Observe the returned error message: “Sorry you are not allowed to remove a book from this shelf: %s” % shelf. 4. Exploitation: - Exploitation Method: In file , line 221, when a user attempts to remove a book from a shelf that does not belong to them, the shelf name is exposed. 5. Remediation: - Remediation Status: Fixed. - Fix Commit: 6f5390 - Verification: Verified. 6. Disclosure: - Disclosure Status: Disclosed. - Disclosure Reward: $96 - Fix Reward: $20 7. Vulnerability Discoverer: - Discoverer: Ileana Barrionuevo - Discoverer ID: @acciobugs - Discoverer Tag: MIDDLEWEIGHT 8. CVE ID: CVE-2021-3986 This information provides a detailed overview of the vulnerability’s nature, impact, reproduction steps, remediation status, and associated rewards.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2021-3986: Information Disclosure in janeczku/calibre-web