PT-2023-15890 · Kaltura · Kaltura Mwembed

Yairans · CVE-2022-4876 · Published 2023-01-04 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kaltura mwEmbed versions up to 2.96.rc1

Description A vulnerability was found in Kaltura mwEmbed, affecting some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP X FORWARDED HOST leads to cross-site scripting. The attack may be initiated remotely.

Recommendations For Kaltura mwEmbed versions up to 2.96.rc1, upgrade to version 2.96.rc2 to address this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4876

Affected Products

Kaltura Mwembed

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4876.json · Exploit
• https://github.com/kaltura/mwEmbed/commit/13b8812ebc8c9fa034eed91ab35ba8423a528c0b · Patch
• https://github.com/kaltura/mwEmbed/pull/4266 · Patch
• https://github.com/kaltura/mwEmbed/releases/tag/v2.96.rc2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4876 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4876 · Vendor Advisory
• https://t.me/cvenotify/43093 · Telegram Post
• https://t.me/cvenotify/60150 · Telegram Post
• https://t.me/cvenotify/41263 · Telegram Post
• https://vuldb.com/?ctiid.217427 · Note
• https://vuldb.com/?id.217427 · Note
• https://t.me/cibsecurity/55926 · Telegram Post