GitHub Advisoryadvisory · npm, Packagist

GHSA-277w-qpxr-2549 MediaElement Vulnerable to Reflected XSS

MEDIUM Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2016-4567
Ecosystem
npm, Packagist
Packages
mediaelement, contao-components/mediaelement, contao/core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-25

Affected packages

• npm mediaelement: < 2.11.1 → fixed in 2.11.1 • Packagist contao-components/mediaelement: >= 2.14.2, < 2.21.1 → fixed in 2.21.1 • Packagist contao/core: >= 3.0.0, < 3.5.15 → fixed in 3.5.15

Description

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

Related

Alias · CVE (1)

  • CVE-2016-4567 Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References