4.3

CVE-2013-2022

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.

Data is provided by the National Vulnerability Database (NVD)
Happyworm ≫ Jplayer Version <= 2.2.22
Happyworm ≫ Jplayer Version0.2.1 Updatebeta
Happyworm ≫ Jplayer Version0.2.2 Updatebeta
Happyworm ≫ Jplayer Version0.2.3 Updatebeta
Happyworm ≫ Jplayer Version0.2.4 Updatebeta
Happyworm ≫ Jplayer Version0.2.5 Updatebeta
Happyworm ≫ Jplayer Version1.0.0
Happyworm ≫ Jplayer Version1.1.0
Happyworm ≫ Jplayer Version1.1.1
Happyworm ≫ Jplayer Version1.2.0
Happyworm ≫ Jplayer Version2.0.0
Happyworm ≫ Jplayer Version2.0.1
Happyworm ≫ Jplayer Version2.0.2
Happyworm ≫ Jplayer Version2.0.3
Happyworm ≫ Jplayer Version2.0.4
Happyworm ≫ Jplayer Version2.0.5
Happyworm ≫ Jplayer Version2.0.6
Happyworm ≫ Jplayer Version2.0.7
Happyworm ≫ Jplayer Version2.0.8
Happyworm ≫ Jplayer Version2.0.9
Happyworm ≫ Jplayer Version2.0.10
Happyworm ≫ Jplayer Version2.0.11
Happyworm ≫ Jplayer Version2.0.12
Happyworm ≫ Jplayer Version2.0.13
Happyworm ≫ Jplayer Version2.0.14
Happyworm ≫ Jplayer Version2.0.15
Happyworm ≫ Jplayer Version2.0.16
Happyworm ≫ Jplayer Version2.0.17
Happyworm ≫ Jplayer Version2.0.18
Happyworm ≫ Jplayer Version2.0.19
Happyworm ≫ Jplayer Version2.0.20
Happyworm ≫ Jplayer Version2.0.21
Happyworm ≫ Jplayer Version2.0.22
Happyworm ≫ Jplayer Version2.0.23
Happyworm ≫ Jplayer Version2.0.24
Happyworm ≫ Jplayer Version2.0.25
Happyworm ≫ Jplayer Version2.0.26
Happyworm ≫ Jplayer Version2.0.27
Happyworm ≫ Jplayer Version2.0.28
Happyworm ≫ Jplayer Version2.0.29
Happyworm ≫ Jplayer Version2.0.30
Happyworm ≫ Jplayer Version2.0.31
Happyworm ≫ Jplayer Version2.0.32
Happyworm ≫ Jplayer Version2.0.33
Happyworm ≫ Jplayer Version2.0.34
Happyworm ≫ Jplayer Version2.0.35
Happyworm ≫ Jplayer Version2.0.36
Happyworm ≫ Jplayer Version2.1.0
Happyworm ≫ Jplayer Version2.1.1
Happyworm ≫ Jplayer Version2.1.2
Happyworm ≫ Jplayer Version2.1.3
Happyworm ≫ Jplayer Version2.1.4
Happyworm ≫ Jplayer Version2.1.5
Happyworm ≫ Jplayer Version2.1.6
Happyworm ≫ Jplayer Version2.2.0
Happyworm ≫ Jplayer Version2.2.1
Happyworm ≫ Jplayer Version2.2.2
Happyworm ≫ Jplayer Version2.2.10
Happyworm ≫ Jplayer Version2.2.11
Happyworm ≫ Jplayer Version2.2.12
Happyworm ≫ Jplayer Version2.2.13
Happyworm ≫ Jplayer Version2.2.14
Happyworm ≫ Jplayer Version2.2.15
Happyworm ≫ Jplayer Version2.2.16
Happyworm ≫ Jplayer Version2.2.17
Happyworm ≫ Jplayer Version2.2.18
Happyworm ≫ Jplayer Version2.2.19
Happyworm ≫ Jplayer Version2.2.20
Happyworm ≫ Jplayer Version2.2.21
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.63% 0.694
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.