MediaElement Vulnerable to Reflected XSS

中 6.1CVE-2016-4567 · GHSA-277w-qpxr-2549 · 22/05/2016 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
contao-components/mediaelement Packagist	`≥ 2.14.2, < 2.21.1`	`2.21.1`
contao/core Packagist	`≥ 3.0.0, < 3.5.15`	`3.5.15`
mediaelement.js mediaelementjs	`≤ 2.20.1`	修正版なし
wordpress wordpress	`≤ 4.5.1`	修正版なし
mediaelement npm	`< 2.11.1`	`2.11.1`

概要

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

NVD の説明

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."