Cross-Site Scripting Vulnerabilities in Kaltura Products
CVE-2017-14142

6.1MEDIUM

Key Information:

Vendor

Kaltura

Status
Kaltura Server
Vendor
CVE Published:
19 September 2017

What is CVE-2017-14142?

Multiple cross-site scripting (XSS) vulnerabilities exist in Kaltura's products prior to version 13.2.0. These vulnerabilities allow remote attackers to inject arbitrary web scripts or HTML through various parameters, including partnerId, playerVersion, and entryId, in several administrative scripts. This exploitation can compromise the integrity of web applications and potentially allow for unauthorized data access.

References

https://github.com/kaltura/server/pull/6003/commits/7e00a...
x_refsource_CONFIRM
https://telekomsecurity.github.io/assets/advisories/20170...
x_refsource_MISC
http://www.securityfocus.com/bid/100976
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.