CVE-2022-4882

low-risk
Published 2023-01-09

A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.

Do I need to act?

-
0.23% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.6/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Mwembed

Affected Vendors

Kaltura

References (10)

Patch https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c6106438...
Patch https://github.com/kaltura/mwEmbed/pull/4255
Release Notes https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1
Permissions Required https://vuldb.com/?ctiid.217664
Permissions Required https://vuldb.com/?id.217664
Patch https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c6106438...
Patch https://github.com/kaltura/mwEmbed/pull/4255
Release Notes https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1
Permissions Required https://vuldb.com/?ctiid.217664
Permissions Required https://vuldb.com/?id.217664
16
/ 100
low-risk
Severity 10/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal