Unscored severity · published Aug 15, 2013
CVE-2013-1942
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jplayer · Happyworm
through 2.2.19; 0.2.1; 0.2.2; 0.2.3; 0.2.4; 0.2.5; +34 more · source: NVD
OW
Owncloud · Owncloud
through 5.0.3 · source: NVD
OS
Owncloud Server · Owncloud
3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +32 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1942
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1942
marc.info
http://marc.info/?l=oss-security&m=136570964825921&w=2
marc.info
http://marc.info/?l=oss-security&m=136726705917858&w=2
marc.info
http://marc.info/?l=oss-security&m=136773622321563&w=2
owncloud.org
http://owncloud.org/about/security/advisories/oC-SA-2013-014/
seclists.org
http://seclists.org/fulldisclosure/2013/Apr/192
www.jplayer.org
http://www.jplayer.org/2.3.0/release-notes/
More from Jplayer
–
CVE-2013-2022
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject…
–
CVE-2013-2023
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary…