Описание
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.
A flaw was found in Calibre's CHM reader. This path traversal vulnerability allows an attacker to write arbitrary files to locations where the user has write permissions. On Windows systems, this could lead to remote code execution by placing a malicious file in the Startup folder, which would then execute upon the user's next login. This vulnerability primarily results in arbitrary code execution.
Отчет
This IMPORTANT flaw in Calibre's CHM reader allows an attacker to perform path traversal, leading to arbitrary file writes. This could enable an attacker to write malicious files to arbitrary locations on the filesystem where the user has write permissions. Exploitation requires a user to open a specially crafted CHM file.
Меры по смягчению последствий
Users should avoid opening untrusted CHM files with Calibre. This operational control reduces the risk of exploitation by preventing the processing of malicious content.
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader con ...
EPSS
8.6 High
CVSS3