{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39307", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-21T18:15:22.259Z", "datePublished": "2024-06-28T20:44:53.930Z", "dateUpdated": "2024-08-02T04:19:20.747Z"}, "containers": {"cna": {"title": "Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84"}], "affected": [{"vendor": "Kareadita", "product": "Kavita", "versions": [{"version": "<= 0.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T20:44:53.930Z"}, "descriptions": [{"lang": "en", "value": "Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1."}], "source": {"advisory": "GHSA-r4qc-3w52-2v84", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-29T13:31:00.681256Z", "id": "CVE-2024-39307", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-29T13:31:07.800Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.747Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39307", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-29T13:31:00.681256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-29T13:31:04.563Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita", "source": {"advisory": "GHSA-r4qc-3w52-2v84", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Kareadita", "product": "Kavita", "versions": [{"status": "affected", "version": "<= 0.8.0"}]}], "references": [{"url": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84", "name": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T20:44:53.930Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39307", "state": "PUBLISHED", "dateUpdated": "2024-06-29T13:31:07.800Z", "dateReserved": "2024-06-21T18:15:22.259Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-28T20:44:53.930Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1."}, {"lang": "es", "value": "Kavita es un servidor de lectura multiplataforma. Abrir un libro electr\u00f3nico que contiene scripts maliciosos conduce a la ejecuci\u00f3n del c\u00f3digo dentro del contexto de navegaci\u00f3n. Kavita no sanitiza ni protege el contenido de los epubs, lo que permite que se ejecuten scripts dentro de los libros electr\u00f3nicos. Esta vulnerabilidad fue parcheada en la versi\u00f3n 0.8.1."}], "id": "CVE-2024-39307", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}]}, "published": "2024-06-28T21:15:03.713", "references": [{"source": "[email protected]", "url": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}]}

{}