CVE-2022-4882 - kaltura mwEmbed Share Plugin share.js cross site scripting

Back Back to CVE browser

MEDIUM

kaltura mwEmbed Share Plugin share.js cross site scripting

Published Jan 9, 2023

4.7

MEDIUM

CVSS 3.1

EPSS 0.56%

Description

A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.

Affected products

Vendor Kaltura Product mwEmbed Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.10
  Status
  affected
  Constraints
  -
- Version
  2.11
  Status
  affected
  Constraints
  -
- Version
  2.12
  Status
  affected
  Constraints
  -
- Version
  2.13
  Status
  affected
  Constraints
  -
- Version
  2.14
  Status
  affected
  Constraints
  -
- Version
  2.15
  Status
  affected
  Constraints
  -
- Version
  2.16
  Status
  affected
  Constraints
  -
- Version
  2.17
  Status
  affected
  Constraints
  -
- Version
  2.18
  Status
  affected
  Constraints
  -
- Version
  2.19
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.20
  Status
  affected
  Constraints
  -
- Version
  2.21
  Status
  affected
  Constraints
  -
- Version
  2.22
  Status
  affected
  Constraints
  -
- Version
  2.23
  Status
  affected
  Constraints
  -
- Version
  2.24
  Status
  affected
  Constraints
  -
- Version
  2.25
  Status
  affected
  Constraints
  -
- Version
  2.26
  Status
  affected
  Constraints
  -
- Version
  2.27
  Status
  affected
  Constraints
  -
- Version
  2.28
  Status
  affected
  Constraints
  -
- Version
  2.29
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.30
  Status
  affected
  Constraints
  -
- Version
  2.31
  Status
  affected
  Constraints
  -
- Version
  2.32
  Status
  affected
  Constraints
  -
- Version
  2.33
  Status
  affected
  Constraints
  -
- Version
  2.34
  Status
  affected
  Constraints
  -
- Version
  2.35
  Status
  affected
  Constraints
  -
- Version
  2.36
  Status
  affected
  Constraints
  -
- Version
  2.37
  Status
  affected
  Constraints
  -
- Version
  2.38
  Status
  affected
  Constraints
  -
- Version
  2.39
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -
- Version
  2.40
  Status
  affected
  Constraints
  -
- Version
  2.41
  Status
  affected
  Constraints
  -
- Version
  2.42
  Status
  affected
  Constraints
  -
- Version
  2.43
  Status
  affected
  Constraints
  -
- Version
  2.44
  Status
  affected
  Constraints
  -
- Version
  2.45
  Status
  affected
  Constraints
  -
- Version
  2.46
  Status
  affected
  Constraints
  -
- Version
  2.47
  Status
  affected
  Constraints
  -
- Version
  2.48
  Status
  affected
  Constraints
  -
- Version
  2.49
  Status
  affected
  Constraints
  -
- Version
  2.5
  Status
  affected
  Constraints
  -
- Version
  2.50
  Status
  affected
  Constraints
  -
- Version
  2.51
  Status
  affected
  Constraints
  -
- Version
  2.52
  Status
  affected
  Constraints
  -
- Version
  2.53
  Status
  affected
  Constraints
  -
- Version
  2.54
  Status
  affected
  Constraints
  -
- Version
  2.55
  Status
  affected
  Constraints
  -
- Version
  2.56
  Status
  affected
  Constraints
  -
- Version
  2.57
  Status
  affected
  Constraints
  -
- Version
  2.58
  Status
  affected
  Constraints
  -
- Version
  2.59
  Status
  affected
  Constraints
  -
- Version
  2.6
  Status
  affected
  Constraints
  -
- Version
  2.60
  Status
  affected
  Constraints
  -
- Version
  2.61
  Status
  affected
  Constraints
  -
- Version
  2.62
  Status
  affected
  Constraints
  -
- Version
  2.63
  Status
  affected
  Constraints
  -
- Version
  2.64
  Status
  affected
  Constraints
  -
- Version
  2.65
  Status
  affected
  Constraints
  -
- Version
  2.66
  Status
  affected
  Constraints
  -
- Version
  2.67
  Status
  affected
  Constraints
  -
- Version
  2.68
  Status
  affected
  Constraints
  -
- Version
  2.69
  Status
  affected
  Constraints
  -
- Version
  2.7
  Status
  affected
  Constraints
  -
- Version
  2.70
  Status
  affected
  Constraints
  -
- Version
  2.71
  Status
  affected
  Constraints
  -
- Version
  2.72
  Status
  affected
  Constraints
  -
- Version
  2.73
  Status
  affected
  Constraints
  -
- Version
  2.74
  Status
  affected
  Constraints
  -
- Version
  2.75
  Status
  affected
  Constraints
  -
- Version
  2.76
  Status
  affected
  Constraints
  -
- Version
  2.77
  Status
  affected
  Constraints
  -
- Version
  2.78
  Status
  affected
  Constraints
  -
- Version
  2.79
  Status
  affected
  Constraints
  -
- Version
  2.8
  Status
  affected
  Constraints
  -
- Version
  2.80
  Status
  affected
  Constraints
  -
- Version
  2.81
  Status
  affected
  Constraints
  -
- Version
  2.82
  Status
  affected
  Constraints
  -
- Version
  2.83
  Status
  affected
  Constraints
  -
- Version
  2.84
  Status
  affected
  Constraints
  -
- Version
  2.85
  Status
  affected
  Constraints
  -
- Version
  2.86
  Status
  affected
  Constraints
  -
- Version
  2.87
  Status
  affected
  Constraints
  -
- Version
  2.88
  Status
  affected
  Constraints
  -
- Version
  2.89
  Status
  affected
  Constraints
  -
- Version
  2.9
  Status
  affected
  Constraints
  -
- Version
  2.90
  Status
  affected
  Constraints
  -
- Version
  2.91
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kaltura

mwEmbed

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.10	affected	-
2.11	affected	-
2.12	affected	-
2.13	affected	-
2.14	affected	-
2.15	affected	-
2.16	affected	-
2.17	affected	-
2.18	affected	-
2.19	affected	-
2.2	affected	-
2.20	affected	-
2.21	affected	-
2.22	affected	-
2.23	affected	-
2.24	affected	-
2.25	affected	-
2.26	affected	-
2.27	affected	-
2.28	affected	-
2.29	affected	-
2.3	affected	-
2.30	affected	-
2.31	affected	-
2.32	affected	-
2.33	affected	-
2.34	affected	-
2.35	affected	-
2.36	affected	-
2.37	affected	-
2.38	affected	-
2.39	affected	-
2.4	affected	-
2.40	affected	-
2.41	affected	-
2.42	affected	-
2.43	affected	-
2.44	affected	-
2.45	affected	-
2.46	affected	-
2.47	affected	-
2.48	affected	-
2.49	affected	-
2.5	affected	-
2.50	affected	-
2.51	affected	-
2.52	affected	-
2.53	affected	-
2.54	affected	-
2.55	affected	-
2.56	affected	-
2.57	affected	-
2.58	affected	-
2.59	affected	-
2.6	affected	-
2.60	affected	-
2.61	affected	-
2.62	affected	-
2.63	affected	-
2.64	affected	-
2.65	affected	-
2.66	affected	-
2.67	affected	-
2.68	affected	-
2.69	affected	-
2.7	affected	-
2.70	affected	-
2.71	affected	-
2.72	affected	-
2.73	affected	-
2.74	affected	-
2.75	affected	-
2.76	affected	-
2.77	affected	-
2.78	affected	-
2.79	affected	-
2.8	affected	-
2.80	affected	-
2.81	affected	-
2.82	affected	-
2.83	affected	-
2.84	affected	-
2.85	affected	-
2.86	affected	-
2.87	affected	-
2.88	affected	-
2.89	affected	-
2.9	affected	-
2.90	affected	-
2.91	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52142
Advisory
https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845
patch
https://github.com/kaltura/mwEmbed/pull/4255
exploitissue-trackingPatch
https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1
patchRelease Notes
https://vuldb.com/?ctiid.217664
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.217664
vdb-entrytechnical-descriptionPermissions Required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52142		Advisory
https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845		patch
https://github.com/kaltura/mwEmbed/pull/4255		exploitissue-trackingPatch
https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1		patchRelease Notes
https://vuldb.com/?ctiid.217664		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.217664		vdb-entrytechnical-descriptionPermissions Required