jQuery jPlayer – CVE-2013-2023

Description

Kayran has detected multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in the version of the jPlayer you use.
This can happen possibly because there are incomplete blacklists.

This is a different vulnerability than CVE-2013-1942 and CVE-2013-2022.

This vulnerability allows remote attackers to inject arbitrary web scripts or any HTML by using unspecified vectors.

Severity/Score

CVSS Version 2.0 – 4.3 Medium

Recommendation

Update the version of the jPlayer being used.
Make sure its version is 2.3.1 or higher.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2023

https://cwe.mitre.org/data/definitions/79.html

< Return to all Vulnerabilities

Exposing the GIT

Let’s start with defining the meaning of GIT. GIT – is an open-source system which we use as a tool to store data and information

Read More »