GitHub Advisoryadvisory · PyPI

GHSA-r735-9gc6-2hvq Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

MEDIUM Published 2024-11-15 Modified 2024-11-19 Official page ↗
Aliases
CVE-2021-3988
Ecosystem
PyPI
Packages
calibreweb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-11-15

Affected packages

• PyPI calibreweb: < 0.6.15 → fixed in 0.6.15

Description

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

Related

Alias · CVE (1)

  • CVE-2021-3988 A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References