Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-1967

Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.

Published

2014-02-05T15:10:05.017

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mediaelementjs	mediaelement.js	≤ 2.11.1	Yes
Application	mediaelementjs	mediaelement.js	1.0.0	Yes
Application	mediaelementjs	mediaelement.js	1.0.1	Yes
Application	mediaelementjs	mediaelement.js	1.0.2	Yes
Application	mediaelementjs	mediaelement.js	1.0.3	Yes
Application	mediaelementjs	mediaelement.js	1.0.4	Yes
Application	mediaelementjs	mediaelement.js	1.0.5	Yes
Application	mediaelementjs	mediaelement.js	1.0.6	Yes
Application	mediaelementjs	mediaelement.js	1.0.7	Yes
Application	mediaelementjs	mediaelement.js	1.1.0	Yes
Application	mediaelementjs	mediaelement.js	1.1.1	Yes
Application	mediaelementjs	mediaelement.js	1.1.2	Yes
Application	mediaelementjs	mediaelement.js	1.1.3	Yes
Application	mediaelementjs	mediaelement.js	1.1.4	Yes
Application	mediaelementjs	mediaelement.js	1.1.5	Yes
Application	mediaelementjs	mediaelement.js	1.1.6	Yes
Application	mediaelementjs	mediaelement.js	1.1.7	Yes
Application	mediaelementjs	mediaelement.js	2.0.0	Yes
Application	mediaelementjs	mediaelement.js	2.0.1	Yes
Application	mediaelementjs	mediaelement.js	2.0.2	Yes
Application	mediaelementjs	mediaelement.js	2.0.3	Yes
Application	mediaelementjs	mediaelement.js	2.0.4	Yes
Application	mediaelementjs	mediaelement.js	2.0.5	Yes
Application	mediaelementjs	mediaelement.js	2.0.6	Yes
Application	mediaelementjs	mediaelement.js	2.0.7	Yes
Application	mediaelementjs	mediaelement.js	2.1.0	Yes
Application	mediaelementjs	mediaelement.js	2.1.1	Yes
Application	mediaelementjs	mediaelement.js	2.1.2	Yes
Application	mediaelementjs	mediaelement.js	2.1.3	Yes
Application	mediaelementjs	mediaelement.js	2.1.4	Yes
Application	mediaelementjs	mediaelement.js	2.1.5	Yes
Application	mediaelementjs	mediaelement.js	2.1.6	Yes
Application	mediaelementjs	mediaelement.js	2.1.7	Yes
Application	mediaelementjs	mediaelement.js	2.1.8	Yes
Application	mediaelementjs	mediaelement.js	2.1.9	Yes
Application	mediaelementjs	mediaelement.js	2.2.0	Yes
Application	mediaelementjs	mediaelement.js	2.2.1	Yes
Application	mediaelementjs	mediaelement.js	2.2.2	Yes
Application	mediaelementjs	mediaelement.js	2.2.3	Yes
Application	mediaelementjs	mediaelement.js	2.2.4	Yes
Application	mediaelementjs	mediaelement.js	2.2.5	Yes
Application	mediaelementjs	mediaelement.js	2.3.0	Yes
Application	mediaelementjs	mediaelement.js	2.3.1	Yes
Application	mediaelementjs	mediaelement.js	2.3.2	Yes
Application	mediaelementjs	mediaelement.js	2.3.3	Yes
Application	mediaelementjs	mediaelement.js	2.4.0	Yes
Application	mediaelementjs	mediaelement.js	2.4.1	Yes
Application	mediaelementjs	mediaelement.js	2.4.2	Yes
Application	mediaelementjs	mediaelement.js	2.4.3	Yes
Application	mediaelementjs	mediaelement.js	2.5.0	Yes
Application	mediaelementjs	mediaelement.js	2.6.0	Yes
Application	mediaelementjs	mediaelement.js	2.6.1	Yes
Application	mediaelementjs	mediaelement.js	2.6.2	Yes
Application	mediaelementjs	mediaelement.js	2.6.3	Yes
Application	mediaelementjs	mediaelement.js	2.6.4	Yes
Application	mediaelementjs	mediaelement.js	2.6.5	Yes
Application	mediaelementjs	mediaelement.js	2.7.0	Yes
Application	mediaelementjs	mediaelement.js	2.8.0	Yes
Application	mediaelementjs	mediaelement.js	2.8.1	Yes
Application	mediaelementjs	mediaelement.js	2.8.2	Yes
Application	mediaelementjs	mediaelement.js	2.9.0	Yes
Application	mediaelementjs	mediaelement.js	2.9.1	Yes
Application	mediaelementjs	mediaelement.js	2.9.2	Yes
Application	mediaelementjs	mediaelement.js	2.9.3	Yes
Application	mediaelementjs	mediaelement.js	2.9.4	Yes
Application	mediaelementjs	mediaelement.js	2.9.5	Yes
Application	mediaelementjs	mediaelement.js	2.10.0	Yes
Application	mediaelementjs	mediaelement.js	2.10.1	Yes
Application	mediaelementjs	mediaelement.js	2.10.2	Yes
Application	mediaelementjs	mediaelement.js	2.10.3	Yes
Application	mediaelementjs	mediaelement.js	2.11.0	Yes
Application	owncloud	owncloud_server	4.5.0	Yes
Application	owncloud	owncloud_server	4.5.1	Yes
Application	owncloud	owncloud_server	4.5.2	Yes
Application	owncloud	owncloud_server	4.5.3	Yes
Application	owncloud	owncloud_server	4.5.4	Yes
Application	owncloud	owncloud_server	4.5.5	Yes
Application	owncloud	owncloud_server	4.5.6	Yes
Application	owncloud	owncloud_server	4.5.7	Yes
Application	owncloud	owncloud_server	4.5.8	Yes
Application	owncloud	owncloud_server	4.5.9	Yes
Application	owncloud	owncloud_server	5.0.0	Yes
Application	owncloud	owncloud_server	5.0.1	Yes
Application	owncloud	owncloud_server	5.0.2	Yes
Application	owncloud	owncloud_server	5.0.3	Yes
Application	owncloud	owncloud_server	5.0.4	Yes

References

http://owncloud.org/about/security/advisories/oC-SA-2013-017 Patch, Vendor Advisory ([email protected])
http://seclists.org/oss-sec/2013/q2/111 ([email protected])
http://seclists.org/oss-sec/2013/q2/133 Patch ([email protected])
http://secunia.com/advisories/53079 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=955307 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/83647 ([email protected])
https://github.com/johndyer/mediaelement/commit/9223dc6bfc50251a9a3cba0210e71be80fc38ecd Exploit, Patch ([email protected])
https://github.com/johndyer/mediaelement/tree/2.11.1 ([email protected])
http://owncloud.org/about/security/advisories/oC-SA-2013-017 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/oss-sec/2013/q2/111 (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/oss-sec/2013/q2/133 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/53079 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=955307 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/83647 (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/johndyer/mediaelement/commit/9223dc6bfc50251a9a3cba0210e71be80fc38ecd Exploit, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/johndyer/mediaelement/tree/2.11.1 (af854a3a-2127-422b-91ae-364da2661108)