PT-2014-3328 · S3 · S3 Video Plugin

Anthony Mills · Publicado 2014-01-08 · Atualizado 2017-08-29 · CVE-2013-7279

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions S3 Video plugin versions prior to 0.983

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is specifically in the base parameter of the views/video-management/preview video.php file.

Recommendations For versions prior to 0.983, update to version 0.983 or later to resolve the issue. As a temporary workaround, consider restricting access to the preview video.php file to minimize the risk of exploitation. Avoid using the base parameter in the affected file until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-7279

Produtos afetados

S3 Video Plugin

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-7279 · Nota de Segurança
• http://secunia.com/advisories/56167 · Aviso do Fabricante
• http://wordpress.org/plugins/s3-video/changelog · Aviso do Fabricante
• http://securityfocus.com/bid/64420 · Nota
• http://plugins.trac.wordpress.org/changeset?old_path=%2Fs3-video&old=823847&new_path=%2Fs3-video&new=823847 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89866 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7279 · Nota