CVE-2024-35236
Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.
Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. Antes de la versión 2.10.0, abrir un libro electrónico con scripts maliciosos en su interior provocaba la ejecución del código dentro del contexto de navegación. Atacar a un usuario con altos privilegios (carga, creación de librerías) puede provocar la ejecución remota de código (RCE) en el peor de los casos. Esto se probó en la versión 2.9.0 en Windows, pero una escritura de archivo arbitraria es lo suficientemente potente como está y debería conducir fácilmente a RCE también en Linux. La versión 2.10.0 contiene un parche para la vulnerabilidad.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-05-14 CVE Reserved
- 2024-05-27 CVE Published
- 2024-05-28 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Advplyr Search vendor "Advplyr" | Audiobookshelf Search vendor "Advplyr" for product "Audiobookshelf" | < 2.10.0 Search vendor "Advplyr" for product "Audiobookshelf" and version " < 2.10.0" | en |
Affected
|