4.3

CVE-2013-2022

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Happyworm ≫ Jplayer Version <= 2.2.22
Happyworm ≫ Jplayer Version 0.2.1 Update beta
Happyworm ≫ Jplayer Version 0.2.2 Update beta
Happyworm ≫ Jplayer Version 0.2.3 Update beta
Happyworm ≫ Jplayer Version 0.2.4 Update beta
Happyworm ≫ Jplayer Version 0.2.5 Update beta
Happyworm ≫ Jplayer Version 1.0.0
Happyworm ≫ Jplayer Version 1.1.0
Happyworm ≫ Jplayer Version 1.1.1
Happyworm ≫ Jplayer Version 1.2.0
Happyworm ≫ Jplayer Version 2.0.0
Happyworm ≫ Jplayer Version 2.0.1
Happyworm ≫ Jplayer Version 2.0.2
Happyworm ≫ Jplayer Version 2.0.3
Happyworm ≫ Jplayer Version 2.0.4
Happyworm ≫ Jplayer Version 2.0.5
Happyworm ≫ Jplayer Version 2.0.6
Happyworm ≫ Jplayer Version 2.0.7
Happyworm ≫ Jplayer Version 2.0.8
Happyworm ≫ Jplayer Version 2.0.9
Happyworm ≫ Jplayer Version 2.0.10
Happyworm ≫ Jplayer Version 2.0.11
Happyworm ≫ Jplayer Version 2.0.12
Happyworm ≫ Jplayer Version 2.0.13
Happyworm ≫ Jplayer Version 2.0.14
Happyworm ≫ Jplayer Version 2.0.15
Happyworm ≫ Jplayer Version 2.0.16
Happyworm ≫ Jplayer Version 2.0.17
Happyworm ≫ Jplayer Version 2.0.18
Happyworm ≫ Jplayer Version 2.0.19
Happyworm ≫ Jplayer Version 2.0.20
Happyworm ≫ Jplayer Version 2.0.21
Happyworm ≫ Jplayer Version 2.0.22
Happyworm ≫ Jplayer Version 2.0.23
Happyworm ≫ Jplayer Version 2.0.24
Happyworm ≫ Jplayer Version 2.0.25
Happyworm ≫ Jplayer Version 2.0.26
Happyworm ≫ Jplayer Version 2.0.27
Happyworm ≫ Jplayer Version 2.0.28
Happyworm ≫ Jplayer Version 2.0.29
Happyworm ≫ Jplayer Version 2.0.30
Happyworm ≫ Jplayer Version 2.0.31
Happyworm ≫ Jplayer Version 2.0.32
Happyworm ≫ Jplayer Version 2.0.33
Happyworm ≫ Jplayer Version 2.0.34
Happyworm ≫ Jplayer Version 2.0.35
Happyworm ≫ Jplayer Version 2.0.36
Happyworm ≫ Jplayer Version 2.1.0
Happyworm ≫ Jplayer Version 2.1.1
Happyworm ≫ Jplayer Version 2.1.2
Happyworm ≫ Jplayer Version 2.1.3
Happyworm ≫ Jplayer Version 2.1.4
Happyworm ≫ Jplayer Version 2.1.5
Happyworm ≫ Jplayer Version 2.1.6
Happyworm ≫ Jplayer Version 2.2.0
Happyworm ≫ Jplayer Version 2.2.1
Happyworm ≫ Jplayer Version 2.2.2
Happyworm ≫ Jplayer Version 2.2.10
Happyworm ≫ Jplayer Version 2.2.11
Happyworm ≫ Jplayer Version 2.2.12
Happyworm ≫ Jplayer Version 2.2.13
Happyworm ≫ Jplayer Version 2.2.14
Happyworm ≫ Jplayer Version 2.2.15
Happyworm ≫ Jplayer Version 2.2.16
Happyworm ≫ Jplayer Version 2.2.17
Happyworm ≫ Jplayer Version 2.2.18
Happyworm ≫ Jplayer Version 2.2.19
Happyworm ≫ Jplayer Version 2.2.20
Happyworm ≫ Jplayer Version 2.2.21
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.72% 0.841
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://marc.info/?l=oss-security&m=136570964825921&w=2
http://marc.info/?l=oss-security&m=136726705917858&w=2
http://marc.info/?l=oss-security&m=136773622321563&w=2
http://seclists.org/fulldisclosure/2013/Apr/192
http://www.jplayer.org/2.3.0/release-notes/
http://www.openwall.com/lists/oss-security/2013/06/27/7
http://www.openwall.com/lists/oss-security/2013/07/04/5
https://github.com/happyworm/jPlayer/commit/c5fe17bb4459164bd59153b57248cf94b8867373