CVE-2021-23414: Cross-site Scripting (XSS)
Published Jul 28, 2021
·Updated
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Affected Software
4 affected components
Videojs Video.js Node.js<7.14.3
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Remediation
Event History
Jul 28, 2021
CVE Published
via MITRE·07:20 AM
Data Sourced
via MITRE·07:20 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-23414?
CVE-2021-23414 has a high severity level due to its ability to execute arbitrary code.
2
How do I fix CVE-2021-23414?
To fix CVE-2021-23414, upgrade Video.js to version 7.14.3 or later.
3
What software is affected by CVE-2021-23414?
CVE-2021-23414 affects Video.js versions prior to 7.14.3 and several versions of Red Hat Fedora.
4
How does CVE-2021-23414 exploit the track tag?
CVE-2021-23414 exploits the track tag by allowing the src attribute to bypass HTML escaping.
5
What impact does CVE-2021-23414 have on users?
CVE-2021-23414 can lead to arbitrary code execution, posing significant security risks to users.