Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-6782 — Incorrect Authorization in Calibre

CWE-863 — Incorrect Authorization7 documents7 sources
Severity
9.8CRITICALNVD
EPSS
93.8%
top 0.13%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
CalibreDebian Calibre
Timeline
PublishedAug 6

Description

Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/calibre< calibre 6.13.0+repack-2+deb12u4 (bookworm)
▶Debiancalibre/calibre< 6.13.0+repack-2+deb12u4+2
▶CVEListV5calibre/calibre6.9.0 — 7.14.0

🔴Vulnerability Details

3
GHSA
GHSA-g8v6-86f6-jj9q: Improper access control in Calibre 6↗2024-08-06
▶
OSV
CVE-2024-6782: Improper access control in Calibre 6↗2024-08-06
▶
VulnCheck
calibre-ebook calibre Incorrect Authorization↗2024
▶

💥Exploits & PoCs

2
Nuclei
Calibre <= 7.14.0 Remote Code Execution
▶
Metasploit
Calibre Python Code Injection (CVE-2024-6782)↗
▶

📋Vendor Advisories

1
Debian
CVE-2024-6782: calibre - Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attacker...↗2024
▶
CVE-2024-6782 — Incorrect Authorization in Calibre | cvebase