CVE-2024-39307: Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita
Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39307?
CVE-2024-39307 is considered a high severity vulnerability due to its ability to execute arbitrary code within the browsing context.
How do I fix CVE-2024-39307?
To fix CVE-2024-39307, upgrade to version 0.8.2 or later of the Kavita software.
What types of attacks can CVE-2024-39307 enable?
CVE-2024-39307 can enable remote code execution attacks by allowing malicious scripts within ebooks to execute.
Is CVE-2024-39307 specific to certain versions of Kavita?
Yes, CVE-2024-39307 affects Kavita versions prior to 0.8.2.
What components of Kavita are impacted by CVE-2024-39307?
CVE-2024-39307 affects the epub handling functionality of the Kavita reading server.