CVE-2021-3988
Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
6.1
MEDIUM
CVSS 3.1
EPSS 0.24%
Description
A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.
How to fix CVE-2021-3988
To remediate CVE-2021-3988, upgrade the affected package to a fixed version below.
- —upgrade to 0.6.15 or later
Is CVE-2021-3988 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.6.15
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |