PT-2023-15896 · Kaltura · Kaltura Mwembed

Published 2023-01-09 · Updated 2024-05-17 · CVE-2022-4882

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions kaltura mwEmbed versions up to 2.91

Description A problem was found in the Share Plugin component, specifically in the file modules/KalturaSupport/components/share/share.js. The issue allows for cross site scripting through the manipulation of the res argument. This can be exploited remotely, but the complexity of the attack is rather high, making exploitation difficult. The exploit has been disclosed publicly.

Recommendations For versions up to 2.91, upgrade to version 2.92.rc1 to address this issue. As a temporary workaround, consider restricting access to the share.js file in the Share Plugin component until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4882

Affected Products

Kaltura Mwembed

References · 8

• 🔥 https://github.com/kaltura/mwEmbed/pull/4255 · Exploit
• https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845 · Patch
• https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4882 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4882 · Vendor Advisory
• https://vuldb.com/?id.217664 · Note
• https://vuldb.com/?ctiid.217664 · Note
• https://t.me/cvenotify/41558 · Telegram Post