CVE-2024-41943

Vulnerability

CVE-2024-41943 is a stored cross-site scripting (XSS) vulnerability in I, Librarian, an open-source PDF management application. The vulnerability exists because PDF notes are displayed on the Item Summary page without any validation or sanitization [1][2]. This allows an attacker to inject malicious HTML or JavaScript code into the notes field.

Exploitation

An attacker who can create or modify PDF notes (e.g., a user with access to the application) can insert a crafted payload. When any user views the affected Item Summary page, the payload is executed in the context of the victim's browser [2]. No additional user interaction beyond viewing the page is required.

Impact

Successful exploitation leads to arbitrary script execution, which can be used to steal session cookies, exfiltrate sensitive data, perform actions on behalf of the victim, or deface the application interface [2]. The CVSS v3 base score is 4.6 (Medium), reflecting the need for some privileges and the potential for scope change.

Mitigation

The vulnerability has been patched in version 5.11.1 of I, Librarian [1][2]. Users are strongly advised to upgrade to this version or later. No workarounds are documented.