Lucene search

GitHub_MVULNRICHMENT:CVE-2024-39307

HistoryJun 28, 2024 - 8:44 p.m.

CVE-2024-39307 Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita

2024-06-2820:44:53

CWE-79

GitHub_M

github.com

cve-2024-39307

cross-site scripting

kavita ebook server

patch

version 0.8.1

code execution

browsing context

epubs

script execution

security vulnerability

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn’t sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.

CNA Affected

[
  {
    "vendor": "Kareadita",
    "product": "Kavita",
    "versions": [
      {
        "status": "affected",
        "version": "<= 0.8.0"
      }
    ]
  }
]

References

github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VULNRICHMENT:CVE-2024-39307