Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package jplayer  (opens in a new tab)

Threat Intelligence

EPSS
2.74% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-JPLAYER-269297
  • published17 Aug 2013
  • disclosed17 Aug 2013
Report a new vulnerability Found a mistake?

Introduced: 17 Aug 2013

CVE-2013-2022  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jplayer package and not the jplayer package as distributed by Ubuntu.

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.