PT-2024-28353 · Janeczku · Calibre-Web

Alexandru Postolache + 1 · Published 2024-07-19 · Updated 2025-07-09 · CVE-2024-39123

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions 0.6.0 through 0.6.21

Description The issue arises from improper sanitization performed by the clean string function, specifically in the way it handles HTML sanitization, making the edit book comments function vulnerable to Cross Site Scripting (XSS).

Recommendations For versions 0.6.0 through 0.6.21, consider disabling the edit book comments function until a patch is available to prevent potential XSS attacks. Restrict access to the clean string function to minimize the risk of exploitation. Avoid using the clean string function for HTML sanitization in the affected versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39123

GHSA-J22R-3RF3-CV25

Affected Products

Calibre-Web

References · 9

• 🔥 https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-39123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39123 · Security Note
• https://osv.dev/vulnerability/GHSA-j22r-3rf3-cv25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39123 · Vendor Advisory
• https://github.com/janeczku/calibre-web · Note
• https://t.me/cvedetector/1236 · Telegram Post
• https://t.me/cvenotify/87032 · Telegram Post
• https://t.me/cvenotify/86818 · Telegram Post
• https://t.me/cvenotify/128189 · Telegram Post