Code Execution Vulnerability in Kaltura Server by Kaltura
CVE-2017-6391

6.1MEDIUM

Key Information:

Vendor

Kaltura

Status
Kaltura Server
Vendor
CVE Published:
2 March 2017

What is CVE-2017-6391?

A vulnerability has been identified in Kaltura Server version Lynx-12.11.0 that allows malicious actors to exploit insufficient user input filtration. This security flaw can lead to the execution of arbitrary HTML and script code within a web browser, potentially jeopardizing the integrity of the website. Specific URLs affected include the admin console tools, such as SimpleJWPlayer.php and AkamaiBroadcaster.php. Proper measures should be taken to filter user inputs effectively to mitigate this risk.

References

http://www.securityfocus.com/bid/96534
vdb-entryx_refsource_BID
https://github.com/kaltura/server/issues/5300
x_refsource_CONFIRM
https://github.com/kaltura/server/commit/041a6d5e8336f771...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.