VulnerabilityModified
CVE-2021-23414
The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
MEDIUM 6.1EPSS 2.55%
Does this matter?
Lower severity and a low EPSS score (2.55%). Track it; it rarely justifies an emergency change on its own.
Description
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.55% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- videojs/video.js · fedoraproject/fedora
- Source
- report@snyk.io
References
- https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429Exploit, Third Party Advisory
- https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.