Unscored severity · published Feb 5, 2014
CVE-2013-1967
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mediaelement.js · Mediaelementjs
through 2.11.1; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more · source: NVD
OS
Owncloud Server · Owncloud
4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1967
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1967
Patch
http://owncloud.org/about/security/advisories/oC-SA-2013-017
seclists.org
http://seclists.org/oss-sec/2013/q2/111
Patch
http://seclists.org/oss-sec/2013/q2/133
Vendor Advisory
http://secunia.com/advisories/53079
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=955307
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/83647
More from Mediaelement.js
6.1
CVE-2016-4567
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject…
5.4
CVE-2022-4699
The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users…