CVE-2021-25964

In Calibre-web application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in Metadata. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
MendCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
janeczkucalibre-web
0.6.0 ≤
𝑥
< 0.6.12
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964
https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964