Lucene search

GitHub_MCVELIST:CVE-2024-39307

HistoryJun 28, 2024 - 8:44 p.m.

CVE-2024-39307 Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita

2024-06-2820:44:53

CWE-79

GitHub_M

www.cve.org

cve-2024-39307

cross-platform reading

malicious scripts

code execution

epubs

patched vulnerability

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS

Percentile

9.1%

JSON

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn’t sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.

CNA Affected

[
  {
    "vendor": "Kareadita",
    "product": "Kavita",
    "versions": [
      {
        "version": "<= 0.8.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-39307