CSRF in Longtailvideo Jw Player For Flash \& Html5 Video Plugin
CVE-2014-4030
Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.029 (86.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 86.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Longtailvideo Jw Player For Flash \& Html5 Video Plugin — versions 2.0.0, 2.0.1, 2.0.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.dxw.com/advisories/jw-player-for-flash-html5-video/ (Exploit)
- wordpress.org/plugins/jw-player-plugin-for-wordpress/changelog (Patch)
- secunia.com/advisories/59173 (third-party-advisory)
- seclists.org/fulldisclosure/2014/Jun/64 (mailing-list, Exploit)
Frequently asked questions
- What is CVE-2014-4030?
- CVE-2014-4030 is a vulnerability in Longtailvideo Jw Player For Flash \& Html5 Video Plugin, classified under Cross-Site Request Forgery (CSRF). Published 2014-06-25.
- Is CVE-2014-4030 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.