CVE-2013-2023 — Cross-site Scripting in Jplayer

CWE-79 — Cross-site ScriptingCWE-284 — Improper Access ControlCWE-918 — Server-Side Request ForgeryCWE-476 — NULL Pointer DereferenceCWE-94 — Code InjectionCWE-190 — Integer Overflow or WraparoundCWE-601 — Open RedirectCWE-502 — Deserialization of Untrusted DataCWE-1021 — UI Misrepresentation / Clickjacking29 documents12 sources
Severity
4.3MEDIUMNVD
CISA8.8
EPSS
0.7%
top 28.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Happyworm JplayerOwncloudOwncloud Server
Timeline
PublishedAug 15
Latest updateMay 2

Description

Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶npmhappyworm/jplayer< 2.3.0
▶NVDhappyworm/jplayer2.2.19+81
▶NVDowncloud/owncloud_server38 versions+37

🔴Vulnerability Details

10
GHSA
GHSA-cg3q-wfc7-4hp7: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer↗2022-05-17
▶
GHSA
jplayer Cross Site Scripting vulnerability↗2022-05-17
▶
OSV
jplayer Cross Site Scripting vulnerability↗2022-05-17
▶
GHSA
GHSA-g3mw-cwj5-rvgj: Cross-site scripting (XSS) vulnerability in actionscript/Jplayer↗2022-05-17
▶
OSV
CVE-2013-2022: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer↗2013-08-17
▶

📋Vendor Advisories

7
Red Hat
kernel: i40e: Fix kernel crash during reboot when adapter is in recovery mode↗2025-05-02
▶
GitLab
CVE-2023-2013: An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7,↗2023-06-07
▶
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability↗2023-04-11
▶
CISA
Microsoft Internet Explorer Memory Corruption Vulnerability↗2023-03-30
▶
Microsoft
Microsoft Word Remote Code Execution Vulnerability↗2023-02-14
▶

💬Community

2
Bugzilla
CVE-2013-1942 CVE-2013-2022 CVE-2013-2023 owncloud: multiple XSS flaws in included Jplayer.as↗2013-08-22
▶
Bugzilla
CVE-2013-1942 CVE-2013-2023 CVE-2013-2022 owncloud: multiple XSS flaws in included Jplayer.as [fedora-all]↗2013-08-22
▶
CVE-2013-2023 — Cross-site Scripting in Jplayer | cvebase