VulnerabilityModified
CVE-2013-1967
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file…
MEDIUM 4.3EPSS 2.21%
Does this matter?
Lower severity and a low EPSS score (2.21%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.21% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mediaelementjs/mediaelement.js · owncloud/owncloud server
- Source
- secalert@redhat.com
References
- http://owncloud.org/about/security/advisories/oC-SA-2013-017Patch, Vendor Advisory
- http://seclists.org/oss-sec/2013/q2/111
- http://seclists.org/oss-sec/2013/q2/133Patch
- http://secunia.com/advisories/53079Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=955307
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83647
- https://github.com/johndyer/mediaelement/commit/9223dc6bfc50251a9a3cba0210e71be80fc38ecdExploit, Patch
- https://github.com/johndyer/mediaelement/tree/2.11.1
- http://owncloud.org/about/security/advisories/oC-SA-2013-017Patch, Vendor Advisory
- http://seclists.org/oss-sec/2013/q2/111
- http://seclists.org/oss-sec/2013/q2/133Patch
- http://secunia.com/advisories/53079Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=955307
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83647
- https://github.com/johndyer/mediaelement/commit/9223dc6bfc50251a9a3cba0210e71be80fc38ecdExploit, Patch
- https://github.com/johndyer/mediaelement/tree/2.11.1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.