Description
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opencast opencast
< 19.7affected>= 20.0, < 20.2affected
polimediaupv paella-player
< 2.12.11affected
References
- https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25 ↗
- https://github.com/opencast/opencast/pull/7736 ↗
- https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40 ↗
- https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b ↗
- https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4 ↗
- https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03 ↗
- https://github.com/opencast/opencast/releases/tag/19.7 ↗
- https://github.com/opencast/opencast/releases/tag/20.2 ↗
- https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21 ↗