CVE-2008-3567 — Cross-site Scripting in Winamp

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 31.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nullsoft Winamp
Timeline
PublishedAug 10
Latest updateMay 2

Description

Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDnullsoft/winamp5.54+71

Patches

Patch: forums.winamp.com ↗Patch: secunia.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-9gcx-wpv9-6wq2: Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5↗2022-05-02
▶