CVE-2021-3988

CVSS V2 None CVSS V3 None

Description

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

Overview

CVE ID
CVE-2021-3988

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-11-15T10:52:39.637Z

Last Modified Date
2024-11-15T10:57:13.347Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/fa4c8fd1-7846-4dad-9112-2c07461f0609
https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2021-3988
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3988

History

Created	Old Value	New Value	Data Type	Notes
2024-11-16 12:05:13				Added to TrackCVE