PT-2014-5960 · Unknown · Html5 Video Player With Playlist
Prajalkulkarni
·
Published
2014-07-02
·
Updated
2014-07-09
·
CVE-2014-4534
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
HTML5 Video Player with Playlist plugin versions 2.4.0 and earlier
Description
The issue allows remote attackers to inject arbitrary web script or HTML via the
theme or playlistmod parameter in the videoplayer/autoplay.php file. This can lead to cross-site scripting (XSS) attacks.Recommendations
For HTML5 Video Player with Playlist plugin versions 2.4.0 and earlier, consider disabling the vulnerable parameters
theme and playlistmod in the videoplayer/autoplay.php file until a patch is available. Restrict access to the videoplayer/autoplay.php file to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Html5 Video Player With Playlist