XSS in Mediaelementjs Mediaelement.js
CVE-2013-1967
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.022 (80.8th percentile) — read the EPSS interpretation.
Affected products
- Mediaelementjs Mediaelement.js — versions 1.0.0, 1.0.1, 1.0.2
- Owncloud Owncloud_server — versions 4.5.0, 4.5.1, 4.5.2
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
- secalert@redhat.com (x_refsource_CONFIRM)