GitHub Advisoryadvisory · npm

GHSA-3jcq-cwr7-6332 jplayer Cross Site Scripting vulnerability

MEDIUM Published 2022-05-17 Modified 2024-04-02 Official page ↗
Aliases
CVE-2013-2022
Ecosystem
npm
Packages
jplayer
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-04-02

Affected packages

• npm jplayer: < 2.3.0 → fixed in 2.3.0

Description

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.

Related

Alias · CVE (1)

  • CVE-2013-2022 Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References