CVE-2013-2022: XSS
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2022?
CVE-2013-2022 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2013-2022?
To fix CVE-2013-2022, upgrade jPlayer to version 2.3.0 or later.
Which versions of jPlayer are affected by CVE-2013-2022?
CVE-2013-2022 affects all versions of jPlayer prior to 2.3.0, including all beta versions from 0.2.1 to 2.2.22.
What types of attacks are possible with CVE-2013-2022?
CVE-2013-2022 allows remote attackers to execute arbitrary web scripts or HTML due to cross-site scripting vulnerabilities.
Is CVE-2013-2022 a common vulnerability?
CVE-2013-2022 is a known vulnerability affecting several releases of jPlayer, making it a relatively common issue in affected installations.