-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| calibreweb | pip | < 0.6.15 | 0.6.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from state-changing operations accepting GET requests without CSRF protection. The patch migrates these routes to POST and adds CSRF token checks. Key indicators include: 1) Route decorators changed from @route('/path') to @route('/path', methods=['POST']), 2) JavaScript AJAX calls updated from GET to POST, 3) Form CSRF tokens added in templates. Functions handling destructive operations (deletion(), shutdown(), sync()) via GET in vulnerable versions are clear CSRF targets.
PythonPythonOngoing coverage of React2Shell