CVE-2013-2022 Detail

CVE-2013-2022

CVE Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	4.3		AV:N/AC:M/Au:N/C:N/I:P/A:N	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Products Mentioned

Configuraton 0

Happyworm>>Jplayer >> Version To (including) 2.2.22

Happyworm>>Jplayer >> Version 0.2.1 (Open CPE detail)
Happyworm>>Jplayer >> Version 0.2.2 (Open CPE detail)
Happyworm>>Jplayer >> Version 0.2.3 (Open CPE detail)
Happyworm>>Jplayer >> Version 0.2.4 (Open CPE detail)
Happyworm>>Jplayer >> Version 0.2.5 (Open CPE detail)
Happyworm>>Jplayer >> Version 1.0.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 1.1.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 1.1.1 (Open CPE detail)
Happyworm>>Jplayer >> Version 1.2.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.1 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.2 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.3 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.4 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.5 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.6 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.7 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.8 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.9 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.10 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.11 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.12 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.13 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.14 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.15 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.16 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.17 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.18 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.19 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.20 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.21 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.22 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.23 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.24 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.25 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.26 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.27 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.28 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.29 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.30 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.31 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.32 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.33 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.34 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.35 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.0.36 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.1 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.2 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.3 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.4 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.5 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.1.6 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.0 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.1 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.2 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.3 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.4 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.5 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.6 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.7 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.8 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.9 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.10 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.11 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.12 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.13 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.14 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.15 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.16 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.17 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.18 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.19 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.20 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.21 (Open CPE detail)
Happyworm>>Jplayer >> Version 2.2.22 (Open CPE detail)

Happyworm>>Jplayer >> Version 0.2.1

Happyworm>>Jplayer >> Version 0.2.1 (Open CPE detail)

Happyworm>>Jplayer >> Version 0.2.2

Happyworm>>Jplayer >> Version 0.2.2 (Open CPE detail)

Happyworm>>Jplayer >> Version 0.2.3

Happyworm>>Jplayer >> Version 0.2.3 (Open CPE detail)

Happyworm>>Jplayer >> Version 0.2.4

Happyworm>>Jplayer >> Version 0.2.4 (Open CPE detail)

Happyworm>>Jplayer >> Version 0.2.5

Happyworm>>Jplayer >> Version 0.2.5 (Open CPE detail)

Happyworm>>Jplayer >> Version 1.0.0

Happyworm>>Jplayer >> Version 1.0.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 1.1.0

Happyworm>>Jplayer >> Version 1.1.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 1.1.1

Happyworm>>Jplayer >> Version 1.1.1 (Open CPE detail)

Happyworm>>Jplayer >> Version 1.2.0

Happyworm>>Jplayer >> Version 1.2.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.0

Happyworm>>Jplayer >> Version 2.0.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.1

Happyworm>>Jplayer >> Version 2.0.1 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.2

Happyworm>>Jplayer >> Version 2.0.2 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.3

Happyworm>>Jplayer >> Version 2.0.3 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.4

Happyworm>>Jplayer >> Version 2.0.4 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.5

Happyworm>>Jplayer >> Version 2.0.5 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.6

Happyworm>>Jplayer >> Version 2.0.6 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.7

Happyworm>>Jplayer >> Version 2.0.7 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.8

Happyworm>>Jplayer >> Version 2.0.8 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.9

Happyworm>>Jplayer >> Version 2.0.9 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.10

Happyworm>>Jplayer >> Version 2.0.10 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.11

Happyworm>>Jplayer >> Version 2.0.11 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.12

Happyworm>>Jplayer >> Version 2.0.12 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.13

Happyworm>>Jplayer >> Version 2.0.13 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.14

Happyworm>>Jplayer >> Version 2.0.14 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.15

Happyworm>>Jplayer >> Version 2.0.15 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.16

Happyworm>>Jplayer >> Version 2.0.16 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.17

Happyworm>>Jplayer >> Version 2.0.17 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.18

Happyworm>>Jplayer >> Version 2.0.18 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.19

Happyworm>>Jplayer >> Version 2.0.19 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.20

Happyworm>>Jplayer >> Version 2.0.20 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.21

Happyworm>>Jplayer >> Version 2.0.21 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.22

Happyworm>>Jplayer >> Version 2.0.22 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.23

Happyworm>>Jplayer >> Version 2.0.23 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.24

Happyworm>>Jplayer >> Version 2.0.24 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.25

Happyworm>>Jplayer >> Version 2.0.25 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.26

Happyworm>>Jplayer >> Version 2.0.26 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.27

Happyworm>>Jplayer >> Version 2.0.27 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.28

Happyworm>>Jplayer >> Version 2.0.28 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.29

Happyworm>>Jplayer >> Version 2.0.29 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.30

Happyworm>>Jplayer >> Version 2.0.30 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.31

Happyworm>>Jplayer >> Version 2.0.31 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.32

Happyworm>>Jplayer >> Version 2.0.32 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.33

Happyworm>>Jplayer >> Version 2.0.33 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.34

Happyworm>>Jplayer >> Version 2.0.34 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.35

Happyworm>>Jplayer >> Version 2.0.35 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.0.36

Happyworm>>Jplayer >> Version 2.0.36 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.0

Happyworm>>Jplayer >> Version 2.1.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.1

Happyworm>>Jplayer >> Version 2.1.1 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.2

Happyworm>>Jplayer >> Version 2.1.2 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.3

Happyworm>>Jplayer >> Version 2.1.3 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.4

Happyworm>>Jplayer >> Version 2.1.4 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.5

Happyworm>>Jplayer >> Version 2.1.5 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.1.6

Happyworm>>Jplayer >> Version 2.1.6 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.0

Happyworm>>Jplayer >> Version 2.2.0 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.1

Happyworm>>Jplayer >> Version 2.2.1 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.2

Happyworm>>Jplayer >> Version 2.2.2 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.10

Happyworm>>Jplayer >> Version 2.2.10 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.11

Happyworm>>Jplayer >> Version 2.2.11 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.12

Happyworm>>Jplayer >> Version 2.2.12 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.13

Happyworm>>Jplayer >> Version 2.2.13 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.14

Happyworm>>Jplayer >> Version 2.2.14 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.15

Happyworm>>Jplayer >> Version 2.2.15 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.16

Happyworm>>Jplayer >> Version 2.2.16 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.17

Happyworm>>Jplayer >> Version 2.2.17 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.18

Happyworm>>Jplayer >> Version 2.2.18 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.19

Happyworm>>Jplayer >> Version 2.2.19 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.20

Happyworm>>Jplayer >> Version 2.2.20 (Open CPE detail)

Happyworm>>Jplayer >> Version 2.2.21

Happyworm>>Jplayer >> Version 2.2.21 (Open CPE detail)

References

https://github.com/happyworm/jPlayer/commit/c5fe17bb4459164bd59153b57248cf94b8867373
Tags : x_refsource_CONFIRM

http://marc.info/?l=oss-security&m=136773622321563&w=2
Tags : mailing-list, x_refsource_MLIST

http://www.openwall.com/lists/oss-security/2013/06/27/7
Tags : mailing-list, x_refsource_MLIST

http://marc.info/?l=oss-security&m=136570964825921&w=2
Tags : mailing-list, x_refsource_MLIST

http://www.jplayer.org/2.3.0/release-notes/
Tags : x_refsource_CONFIRM

http://www.openwall.com/lists/oss-security/2013/07/04/5
Tags : mailing-list, x_refsource_MLIST

http://seclists.org/fulldisclosure/2013/Apr/192
Tags : mailing-list, x_refsource_FULLDISC

http://marc.info/?l=oss-security&m=136726705917858&w=2
Tags : mailing-list, x_refsource_MLIST

CVE-2013-2022 : Detail