CVE-2024-35236

Katalog CVE

CVSS 4.8 · Medium EPSS 0,83%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada audiobookshelf. Skor CVSS 3.1 4.8 (Medium) menurut github.com.

Deskripsi (NVD)

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.

Rincian

Terbit di NVD

27 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg exploit · advisory vendor
• https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664 patch
• https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d exploit
• https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/read... product
• https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0 release notes