« Volver al listado

CVE-2017-6391

Estado: ModificadaMedia (6.1)—

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Kaltura — Kaltura Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-6391",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-02T06:59:00.340",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96534",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/kaltura/server/commit/041a6d5e8336f7713985b120139c8f4b6279a337",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/kaltura/server/issues/5300",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/96534",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/kaltura/server/commit/041a6d5e8336f7713985b120139c8f4b6279a337",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/kaltura/server/issues/5300",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the \"admin_console/web/tools/SimpleJWPlayer.php\" URL, the \"admin_console/web/tools/AkamaiBroadcaster.php\" URL, the \"admin_console/web/tools/bigRedButton.php\" URL, and the \"admin_console/web/tools/bigRedButtonPtsPoc.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en el servidor Lynx-12.11.0 de Kaltura. La vulnerabilidad existe debido a filtración insuficiente de datos suministrados por el usuario pasados a la URL \"admin_console/web/tools/SimpleJWPlayer.php\", la URL \"admin_console/web/tools/AkamaiBroadcaster.php\", la URL \"admin_console/web/tools/bigRedButton.php\" y la URL \"admin_console/web/tools/bigRedButtonPtsPoc.php\". Un atacante podría ejecutar código HTML y secuencia de comandos arbitrario en un buscador en el contexto de un sitio web vulnerable."
    }
  ],
  "lastModified": "2026-06-17T01:22:15.240",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kaltura:kaltura_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9736FE19-44FC-41B0-8C43-290446A87E2D",
              "versionEndIncluding": "lynx-12.11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}