PT-2023-15915 · Icplayer · Icplayer

CVE-2022-4928 · Publicado 2023-03-06 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions icplayer versions up to 0.819

Description A vulnerability was found in icplayer, affecting the function AddonText Selection create of the file addons/Text Selection/src/presenter.js. This issue leads to cross-site scripting and can be launched remotely.

Recommendations For versions up to 0.819, upgrade to version 0.820 to address this issue. As a temporary workaround, consider disabling the AddonText Selection create function until the patch is applied. Restrict access to the addons/Text Selection/src/presenter.js file to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-4928

Produtos afetados

Icplayer

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4928.json · Exploit
• https://github.com/icplayer/icplayer/commit/2223628e6db1df73f6d633d2c0422d995990f0a3 · Correção
• https://github.com/icplayer/icplayer/releases/tag/v0.820 · Correção
• https://github.com/icplayer/icplayer/pull/881 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2022-4928 · Nota de Segurança
• https://t.me/cvenotify/45564 · Publicação no Telegram
• https://t.me/cibsecurity/59447 · Publicação no Telegram
• https://vuldb.com/?ctiid.222289 · Nota
• https://vuldb.com/?id.222289 · Nota
• https://osv.dev/vulnerability/CVE-2022-4928 · Aviso do Fabricante