CVE-2021-3988

Summary

CVE-2021-3988 is a Cross-site Scripting (XSS) vulnerability discovered in the janeczku/calibre-web repository, specifically in the `edit_books.js` file. This issue arises when editing book properties, such as uploading a cover or a format, due to insufficient sanitization of user input. The affected code directly inserts user input into the DOM, enabling attackers to execute arbitrary JavaScript code. Potential attacks can result in cookie theft and other malicious activities. The vulnerability lies within the event handler for the `#btn-upload-cover` change event.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.