CVE-2013-7342: XSS

Published Mar 22, 2014

Updated

Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341.

Affected Software

1 affected component

Flowplayer Flowplayer HTML5=5.4.1

Remediation

Patch Available

https://github.com/flowplayer/flowplayer/commit/017f8c2a0865ab31e01d591adc43d34f2dd60e59

Event History

Mar 22, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Mar 24, 2014

Data Sourced

via NVD·02:20 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-7342?

CVE-2013-7342 is categorized as a cross-site scripting (XSS) vulnerability, which can lead to significant security risks if exploited.

How do I fix CVE-2013-7342?

To fix CVE-2013-7342, upgrade to a version of Flowplayer HTML5 that is not affected by this vulnerability, such as versions after 5.4.1.

What software is affected by CVE-2013-7342?

CVE-2013-7342 affects Flowplayer HTML5 version 5.4.1.

What type of vulnerability is CVE-2013-7342?

CVE-2013-7342 is a cross-site scripting (XSS) vulnerability allowing remote attackers to inject arbitrary scripts.

Can CVE-2013-7342 be exploited remotely?

Yes, CVE-2013-7342 can be exploited remotely through manipulated callback parameters.