CVE-2024-39123

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

23.07% chance of exploitation in the next 30 days, 98th percentile

Published

2024-07-19

Updated

2024-08-02

Proof-of-concept exploits (3)

• pentesttoolscom/vulnerability-research/tree/master/CVE-2024-39123
• FelinaeBlanc/CVE_2024_391230★ · 2025-02-01
• theexploiters/CVE-2024-39123-Exploit2★ · 2025-01-10

References

• CVE Record
• NVD entry

Related

• CVE-2024-6781
• CVE-2024-27115
• CVE-2024-36840
• CVE-2024-40111
• CVE-2024-42845
• CVE-2024-3912