CVE-2024-35236

{"id": "CVE-2024-35236", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-05-27T17:15:09.990", "references": [{"url": "https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability."}, {"lang": "es", "value": "Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. Antes de la versi\u00f3n 2.10.0, abrir un libro electr\u00f3nico con scripts maliciosos en su interior provocaba la ejecuci\u00f3n del c\u00f3digo dentro del contexto de navegaci\u00f3n. Atacar a un usuario con altos privilegios (carga, creaci\u00f3n de librer\u00edas) puede provocar la ejecuci\u00f3n remota de c\u00f3digo (RCE) en el peor de los casos. Esto se prob\u00f3 en la versi\u00f3n 2.9.0 en Windows, pero una escritura de archivo arbitraria es lo suficientemente potente como est\u00e1 y deber\u00eda conducir f\u00e1cilmente a RCE tambi\u00e9n en Linux. La versi\u00f3n 2.10.0 contiene un parche para la vulnerabilidad."}], "lastModified": "2025-07-10T17:32:33.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF91663-C22B-4BC7-BAA7-D28AEE1039DD", "versionEndExcluding": "2.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}