CVE-2024-7008

published 2024-08-06

CVE-2024-7008: Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

Priority P3 46 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

EXPLOIT

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
calibre-ebook	calibre	<= 7.15.0	—
calibre	calibre	—	—
calibre	calibre	>= 0 < 5.12.0+dfsg-1+deb11u2	5.12.0+dfsg-1+deb11u2
calibre	calibre	>= 0 < 6.13.0+repack-2+deb12u4	6.13.0+repack-2+deb12u4
calibre	calibre	>= 0 < 7.16.0+ds-1	7.16.0+ds-1
calibre	calibre	>= 0 < 7.16.0+ds-1	7.16.0+ds-1
debian	calibre	< calibre 6.13.0+repack-2+deb12u4 (bookworm)	calibre 6.13.0+repack-2+deb12u4 (bookworm)

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

osv 6.1 MEDIUM

vendor_debian 5.4 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79