Vulnerability CVE-2013-3565
Published: 2020-01-31   Modified: 2020-02-01

Description:
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.

Type:

CWE-79

 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Videolan -> Vlc media player 
Opensuse -> Opensuse 

 References:
http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git;a=commitdiff;h=bf02b8dd211d5a52aa301a9a2ff4e73ed8195881
http://lists.opensuse.org/opensuse-updates/2014-03/msg00001.html
http://www.videolan.org/developers/vlc-branch/NEWS
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-007.txt
Copyright 2024, cxsecurity.com

 

Back to Top