PT-2022-21196 · Realnetworks · Realplayer

Published 2022-06-03 · Updated 2022-06-13 · CVE-2022-32271

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Real Player version 20.0.8.310

Description The issue concerns an internal URL protocol used by Real Player to reference files containing URLs, allowing for the injection of script code into arbitrary domains and the referencing of arbitrary local files. This is related to the DCP:// URI protocol.

Recommendations For Real Player version 20.0.8.310, consider disabling the use of the DCP:// URI protocol until a patch is available to prevent the injection of script code and the referencing of arbitrary local files. Restrict access to the internal URL protocol to minimize the risk of exploitation. Avoid using the DCP:// URI protocol in Real Player until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32271

Affected Products

Realplayer

References · 6

• 🔥 https://github.com/Edubr2020/RP_DCP_Code_Exec · Exploit
• 🔥 https://youtu.be/AMODp3iTnqY · Exploit
• https://osv.dev/vulnerability/CVE-2022-32271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32271 · Security Note
• https://t.me/cvenotify/31051 · Telegram Post
• https://t.me/cibsecurity/43791 · Telegram Post