CVE-2017-14142

moderate-risk
Published 2017-09-19

Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerId or (2) playerVersion parameter to server/admin_console/web/tools/bigRedButton.php; the (3) partnerId, (4) playerVersion, (5) secret, (6) entryId, (7) adminUiConfId, or (8) uiConfId parameter to server/admin_console/web/tools/bigRedButtonPtsPoc.php; the (9) streamUsername, (10) streamPassword, (11) streamRemoteId, (12) streamRemoteBackupId, or (13) entryId parameter to server/admin_console/web/tools/AkamaiBroadcaster.php; the (14) entryId parameter to server/admin_console/web/tools/XmlJWPlayer.php; or the (15) partnerId or (16) playerVersion parameter to server/alpha/web/lib/bigRedButtonPtsPocHlsjs.php.

Do I need to act?

-
0.48% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Kaltura

References (8)

Third Party Advisory http://www.securityfocus.com/bid/100976
Third Party Advisory https://github.com/kaltura/server/pull/6003/commits/7e00a578d6ba748f6d3bdc255a40...
Third Party Advisory https://github.com/kaltura/server/pull/6003/commits/a63362aa87d668d5ebf4a89cdd5b...
Exploit https://telekomsecurity.github.io/assets/advisories/20170912_kaltura-advisory.tx...
Third Party Advisory http://www.securityfocus.com/bid/100976
Third Party Advisory https://github.com/kaltura/server/pull/6003/commits/7e00a578d6ba748f6d3bdc255a40...
Third Party Advisory https://github.com/kaltura/server/pull/6003/commits/a63362aa87d668d5ebf4a89cdd5b...
Exploit https://telekomsecurity.github.io/assets/advisories/20170912_kaltura-advisory.tx...
30
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal