« Volver al listado

CVE-2025-55165

Estado: AplazadaAlta (8.2)—

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R (interacción usuario para compartir debug pack). Exposición de credenciales (API keys) en datos serializados sin filtrado adecuado (CWE-200 información sensible).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict File and Directory PermissionsPassword PoliciesAuditApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gelbphoenix — AutocaliwebAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-55165",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-55165",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-13T17:49:00.573245Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gelbphoenix",
          "product": "autocaliweb",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.8.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-12T21:15:43.320",
  "references": [
    {
      "url": "https://github.com/gelbphoenix/autocaliweb/commit/f455051f7c758ae8490186718b73e449f353b702",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gelbphoenix/autocaliweb/releases/tag/v0.8.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3."
    },
    {
      "lang": "es",
      "value": "Autocaliweb es una aplicación web que ofrece una interfaz para explorar, leer y descargar ebooks mediante una base de datos Calibre válida. Antes de la versión 0.8.3, el paquete de depuración generado por Autocaliweb podía exponer datos de configuración confidenciales, incluidas las claves API. Esto se debe a que el método to_dict(), utilizado para serializar la configuración del paquete de depuración, no filtra adecuadamente los campos confidenciales, como los tokens API. Los usuarios, sin conocer el contenido completo, podrían compartir estos paquetes de depuración, filtrando inadvertidamente sus claves API privadas. Este problema se ha corregido en la versión 0.8.3."
    }
  ],
  "lastModified": "2026-06-17T09:41:23.270",
  "sourceIdentifier": "security-advisories@github.com"
}