PT-2021-15503 · Video.Js+1 · Video.Js+1

Published 2021-07-28 · Updated 2023-08-25 · CVE-2021-23414

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions video.js versions prior to 7.14.3

Description The issue allows bypassing HTML escaping and executing arbitrary code through the src attribute of the track tag.

Recommendations For versions prior to 7.14.3, update to version 7.14.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the track tag's src attribute to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-2012

ALT-PU-2023-2057

ALT-PU-2023-5127

CVE-2021-23414

GHSA-PP7M-6J83-M7R6

SNYK-JAVA-ORGWEBJARSBOWER-1533588

SNYK-JAVA-ORGWEBJARSNPM-1533587

SNYK-JS-VIDEOJS-1533429

Affected Products

Alt Linux

Video.Js

References · 17

• 🔥 https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587 · Exploit
• https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp7m-6j83-m7r6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23414 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23414 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV · Vendor Advisory
• https://github.com/videojs/video.js · Note
• https://t.me/cvenotify/18636 · Telegram Post