4.3
CVE-2013-1464
- EPSS 6.41%
- Veröffentlicht 07.02.2013 05:56:25
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginAudio Player <= 2.0.4.5 - Cross-Site Scripting via playerID Parameter
Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.
Mögliche Gegenmaßnahme
audio-player: Update to version 2.0.4.6, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Doryphores ≫ Audio Player Version <= 2.0.4.5
Doryphores ≫ Audio Player Version2.0.1.0
Doryphores ≫ Audio Player Version2.0.2.0
Doryphores ≫ Audio Player Version2.0.3.0
Doryphores ≫ Audio Player Version2.0.3.1
Doryphores ≫ Audio Player Version2.0.4.0
Doryphores ≫ Audio Player Version2.0.4.1
Doryphores ≫ Audio Player Version2.0.4.3
Doryphores ≫ Audio Player Version2.0.4.4
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
audio-player
Version
[*, 2.0.4.6)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.41% | 0.928 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://insight-labs.org/?p=738
http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html
http://secunia.com/advisories/52083
http://secunia.com/advisories/58854
http://wordpress.org/extend/plugins/audio-player/changelog/
http://www.securityfocus.com/bid/57848
https://www.wordfence.com/threat-intel/vulnerabilities/id/7b70b152-eb65-4273-8063-37cfec7ecefb