CVE-2013-2022: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-08-17T16:55Z
Repository: https://github.com/happyworm/jPlayer
Language: Other
Files changed: actionscript/Jplayer.as, actionscript/happyworm/jPlayer/JplayerStatus.as, jquery.jplayer/jquery.jplayer.js
Commit date: 2013-04-12 15:59:53 +0100
Commit message: Security Fox of Flash SWF that had enabled Cross Site Scripting (XSS)

Diff: diff --git a/actionscript/Jplayer.as b/actionscript/Jplayer.as
index 4752d34..638b59c 100644
--- a/actionscript/Jplayer.as
+++ b/actionscript/Jplayer.as
@@ -237,11 +237,11 @@ package {
 			if(i === 0 || securityIssue) {
 				directAccess = true;
 			}
 		}
 		private function illegalChar(s:String):Boolean {
-			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
+			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
 			if(Boolean(s)) { // Otherwise exception if parameter null.
 				for each (var illegal:String in illegals.split(' ')) {
 					if(s.indexOf(illegal) >= 0) {
 						return true; // Illegal char found
 					}
diff --git a/actionscript/happyworm/jPlayer/JplayerStatus.as b/actionscript/happyworm/jPlayer/JplayerStatus.as
index 7e369d8..e11a064 100644
--- a/actionscript/happyworm/jPlayer/JplayerStatus.as
+++ b/actionscript/happyworm/jPlayer/JplayerStatus.as
@@ -12,11 +12,11 @@
  */
 
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()
 
 		public var src:String;
diff --git a/jquery.jplayer/Jplayer.swf b/jquery.jplayer/Jplayer.swf
index 4a6b635..e96a6cb 100644
Binary files a/jquery.jplayer/Jplayer.swf and b/jquery.jplayer/Jplayer.swf differ
diff --git a/jquery.jplayer/jquery.jplayer.js b/jquery.jplayer/jquery.jplayer.js
index e067699..b297331 100644
--- a/jquery.jplayer/jquery.jplayer.js
+++ b/jquery.jplayer/jquery.jplayer.js
@@ -6,12 +6,12 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.22
- * Date: 29th March 2013
+ * Version: 2.2.23
+ * Date: 12th April 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
 /*jshint asi:false, bitwise:false, boss:false, browser:true, curly:true, debug:false, eqeqeq:true, eqnull:false, evil:false, forin:false, immed:false, jquery:true, laxbreak:false, newcap:true, noarg:true, noempty:true, nonew:true, onevar:false, passfail:false, plusplus:false, regexp:false, undef:true, sub:false, strict:false, white:false, smarttabs:true */
 /*global define:false, ActiveXObject:false, alert:false */
@@ -452,12 +452,12 @@
 	$.jPlayer.keys(true);
 
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.2.22",
-			needFlash: "2.2.20",
+			script: "2.2.23",
+			needFlash: "2.2.23",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor
 			swfPath: "js", // Path to Jplayer.swf. Can be relative, absolute or server root relative.
 			solution: "html, flash", // Valid solutions: html, flash. Order defines priority. 1st is highest,

Vulnerable code: 			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
 * Version: 2.2.22
 * Date: 29th March 2013
			script: "2.2.22",
			needFlash: "2.2.20",
Fixed code: 			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 * Version: 2.2.23
 * Date: 12th April 2013
			script: "2.2.23",
			needFlash: "2.2.23",