PT-2022-8298 · Unknown · Iet-Ou Open Media Player

Published 2022-12-27 · Updated 2024-05-17 · CVE-2019-25086

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IET-OU Open Media Player versions up to 1.5.0

Description A vulnerability was found in the function webvtt of the file application/controllers/timedtext.php. The manipulation of the argument ttml url leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For IET-OU Open Media Player versions up to 1.5.0, upgrade to version 1.5.1 to address this issue. As a temporary workaround, consider restricting access to the webvtt function in the timedtext.php file until the upgrade is applied. Additionally, avoid using the ttml url argument in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25086

Affected Products

Iet-Ou Open Media Player

References · 11

• https://github.com/IET-OU/open-media-player/releases/tag/1.5.1 · Patch
• https://github.com/IET-OU/open-media-player/commit/3f39f2d68d11895929c04f7b49b97a734ae7cd1f · Patch
• https://github.com/IET-OU/open-media-player/issues/93 · Patch
• https://iet.eu.teamwork.com/desk/#/tickets/366419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25086 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25086 · Vendor Advisory
• https://t.me/cibsecurity/55385 · Telegram Post
• https://vuldb.com/?ctiid.216862 · Note
• https://vuldb.com/?id.216862 · Note
• https://t.me/cvenotify/40761 · Telegram Post
• https://t.me/cvenotify/41369 · Telegram Post