CVE-2021-3988CWE-79

Cross-site Scripting (XSS) in janeczku/calibre-web

Medium · published November 15, 2024

CVSS v3.0
5.7
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

The record
Technical detail
CVSS v3.0
5.7 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-15T10:52Z
EPSS history
Timeline
  • 15 NOV 10:52Z
    Cross-site Scripting (XSS) in janeczku/calibre-web
    cvelistv5