Foliovision FV Flowplayer Video Player Vulnerable to Reflected XSS

CVE-2024-35631

Summary

A cross-site scripting (XSS) vulnerability exists in the Foliovision FV Flowplayer Video Player. This flaw is due to improper handling of input during web page generation, enabling attackers to execute arbitrary scripts in the context of the user’s browser. The vulnerability specifically affects versions of the FV Flowplayer Video Player from unassigned states up to and including version 7.5.45.7212, potentially allowing malicious actors to manipulate web pages and execute unauthorized actions on behalf of users. Website administrators using affected versions are urged to evaluate their vulnerability and consider appropriate mitigation steps to safeguard their users.

References