PT-2014-3328 · S3 · S3 Video Plugin

Anthony Mills · Published 2014-01-08 · Updated 2017-08-29 · CVE-2013-7279

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions S3 Video plugin versions prior to 0.983

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is specifically in the base parameter of the views/video-management/preview video.php file.

Recommendations For versions prior to 0.983, update to version 0.983 or later to resolve the issue. As a temporary workaround, consider restricting access to the preview video.php file to minimize the risk of exploitation. Avoid using the base parameter in the affected file until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-7279

Affected Products

S3 Video Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-7279 · Security Note
• http://secunia.com/advisories/56167 · Vendor Advisory
• http://wordpress.org/plugins/s3-video/changelog · Vendor Advisory
• http://securityfocus.com/bid/64420 · Note
• http://plugins.trac.wordpress.org/changeset?old_path=%2Fs3-video&old=823847&new_path=%2Fs3-video&new=823847 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89866 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7279 · Note