Cyber Resilience

CVE-2024-39123

MediumPublic PoC

Published: 19 July 2024

Published
19 July 2024
Modified
09 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.1645 95.0th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39123 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Janeczku Calibre-Web. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

In janeczku Calibre-Web versions 0.6.0 through 0.6.21, the edit_book_comments function contains a cross-site scripting vulnerability (CWE-79) caused by insufficient HTML sanitization inside the clean_string function. The flaw received a CVSS 3.1 score of 5.4 and permits injection of script content when book comments are edited.

An authenticated user with low privileges can supply crafted input that is later rendered for other users; because the scope is changed, successful exploitation can expose or manipulate limited data within the affected Calibre-Web instance after a victim interacts with the page.

Public references consist of technical write-ups hosted in a GitHub repository that document the discovery but do not include official patch guidance or mitigation steps from the project maintainers.

EPSS for the CVE rose from a low baseline to a peak of 0.2712 before receding to the current value of 0.1645, indicating measurable post-disclosure exploitation interest.

EU & UK References

Vulnerability details

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

XSS vulnerability enables injection of malicious JavaScript into the web application, facilitating JavaScript execution (T1059.007), browser session hijacking (T1185), exploitation of public-facing web applications (T1190), and exploitation for client execution (T1203).

Affected Assets

janeczku
calibre-web
0.6.0 — 0.6.21

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

SI-10 Information Input Validation
addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

SI-15 Information Output Filtering
addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References