4.3

CVE-2013-2023

Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Happyworm ≫ Jplayer Version <= 2.3.0
Happyworm ≫ Jplayer Version0.2.1 Updatebeta
Happyworm ≫ Jplayer Version0.2.2 Updatebeta
Happyworm ≫ Jplayer Version0.2.3 Updatebeta
Happyworm ≫ Jplayer Version0.2.4 Updatebeta
Happyworm ≫ Jplayer Version0.2.5 Updatebeta
Happyworm ≫ Jplayer Version1.0.0
Happyworm ≫ Jplayer Version1.1.0
Happyworm ≫ Jplayer Version1.1.1
Happyworm ≫ Jplayer Version1.2.0
Happyworm ≫ Jplayer Version2.0.0
Happyworm ≫ Jplayer Version2.0.1
Happyworm ≫ Jplayer Version2.0.2
Happyworm ≫ Jplayer Version2.0.3
Happyworm ≫ Jplayer Version2.0.4
Happyworm ≫ Jplayer Version2.0.5
Happyworm ≫ Jplayer Version2.0.6
Happyworm ≫ Jplayer Version2.0.7
Happyworm ≫ Jplayer Version2.0.8
Happyworm ≫ Jplayer Version2.0.9
Happyworm ≫ Jplayer Version2.0.10
Happyworm ≫ Jplayer Version2.0.11
Happyworm ≫ Jplayer Version2.0.12
Happyworm ≫ Jplayer Version2.0.13
Happyworm ≫ Jplayer Version2.0.14
Happyworm ≫ Jplayer Version2.0.15
Happyworm ≫ Jplayer Version2.0.16
Happyworm ≫ Jplayer Version2.0.17
Happyworm ≫ Jplayer Version2.0.18
Happyworm ≫ Jplayer Version2.0.19
Happyworm ≫ Jplayer Version2.0.20
Happyworm ≫ Jplayer Version2.0.21
Happyworm ≫ Jplayer Version2.0.22
Happyworm ≫ Jplayer Version2.0.23
Happyworm ≫ Jplayer Version2.0.24
Happyworm ≫ Jplayer Version2.0.25
Happyworm ≫ Jplayer Version2.0.26
Happyworm ≫ Jplayer Version2.0.27
Happyworm ≫ Jplayer Version2.0.28
Happyworm ≫ Jplayer Version2.0.29
Happyworm ≫ Jplayer Version2.0.30
Happyworm ≫ Jplayer Version2.0.31
Happyworm ≫ Jplayer Version2.0.32
Happyworm ≫ Jplayer Version2.0.33
Happyworm ≫ Jplayer Version2.0.34
Happyworm ≫ Jplayer Version2.0.35
Happyworm ≫ Jplayer Version2.0.36
Happyworm ≫ Jplayer Version2.1.0
Happyworm ≫ Jplayer Version2.1.1
Happyworm ≫ Jplayer Version2.1.2
Happyworm ≫ Jplayer Version2.1.3
Happyworm ≫ Jplayer Version2.1.4
Happyworm ≫ Jplayer Version2.1.5
Happyworm ≫ Jplayer Version2.1.6
Happyworm ≫ Jplayer Version2.2.0
Happyworm ≫ Jplayer Version2.2.1
Happyworm ≫ Jplayer Version2.2.2
Happyworm ≫ Jplayer Version2.2.3
Happyworm ≫ Jplayer Version2.2.4
Happyworm ≫ Jplayer Version2.2.5
Happyworm ≫ Jplayer Version2.2.6
Happyworm ≫ Jplayer Version2.2.7
Happyworm ≫ Jplayer Version2.2.8
Happyworm ≫ Jplayer Version2.2.9
Happyworm ≫ Jplayer Version2.2.10
Happyworm ≫ Jplayer Version2.2.11
Happyworm ≫ Jplayer Version2.2.12
Happyworm ≫ Jplayer Version2.2.13
Happyworm ≫ Jplayer Version2.2.14
Happyworm ≫ Jplayer Version2.2.15
Happyworm ≫ Jplayer Version2.2.16
Happyworm ≫ Jplayer Version2.2.17
Happyworm ≫ Jplayer Version2.2.18
Happyworm ≫ Jplayer Version2.2.19
Happyworm ≫ Jplayer Version2.2.20
Happyworm ≫ Jplayer Version2.2.21
Happyworm ≫ Jplayer Version2.2.22
Happyworm ≫ Jplayer Version2.2.23
Happyworm ≫ Jplayer Version2.2.24
Happyworm ≫ Jplayer Version2.2.25
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.46% 0.823
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://marc.info/?l=oss-security&m=136570964825921&w=2
http://marc.info/?l=oss-security&m=136726705917858&w=2
http://marc.info/?l=oss-security&m=136773622321563&w=2
http://seclists.org/fulldisclosure/2013/Apr/192
http://www.jplayer.org/latest/release-notes/
http://www.openwall.com/lists/oss-security/2013/06/27/7
http://www.openwall.com/lists/oss-security/2013/07/04/5
https://github.com/happyworm/jPlayer/commit/8ccc429598d62eebe9f65a0a4e6fd406a123c8b4
https://github.com/happyworm/jPlayer/commit/c2417972af1295be8dcc07470b0e3d25b0a77e0b
https://github.com/happyworm/jPlayer/issues/162