A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.
References
Configurations
History
19 Nov 2024, 15:43
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5 - Patch | |
| References | () https://huntr.com/bounties/fa4c8fd1-7846-4dad-9112-2c07461f0609 - Exploit | |
| CPE | cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:* | |
| First Time |
Janeczku calibre-web
Janeczku |
15 Nov 2024, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-15 11:15
Updated : 2024-11-19 15:43
NVD link : CVE-2021-3988
Mitre link : CVE-2021-3988
JSON object : View
Products Affected
janeczku
- calibre-web
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')