Lucene search

STAR_LabsCVELIST:CVE-2024-7008

HistoryAug 06, 2024 - 3:40 a.m.

CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

2024-08-0603:40:01

CWE-79

STAR_Labs

www.cve.org

calibre

unsanitized user-input

reflected cross-site scripting

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

31.2%

JSON

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Calibre",
    "repo": "https://github.com/kovidgoyal/calibre",
    "vendor": "Calibre",
    "versions": [
      {
        "status": "affected",
        "version": "7.15.0"
      }
    ]
  }
]

References

github.com/kovidgoyal/calibre/commit/863abac24e7bc3e5ca0b3307362ff1953ba53fe0

starlabs.sg/advisories/24/24-7008/

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

31.2%

JSON

Related for CVELIST:CVE-2024-7008