CVE-2013-2023 (Other, published 2013-08-15T17:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/happyworm/jPlayer
Files changed:
actionscript/Jplayer.as
actionscript/happyworm/jPlayer/JplayerStatus.as
jquery.jplayer/jquery.jplayer.js
package.json
Commit message: Security Fix issue #162 for CVE-2013-2023


Vulnerable code:
 * Version: 2.3.0
 * Date: 20th April 2013
		private var securityIssue:Boolean = false; // When SWF parameters contain illegal characters
		private var directAccess:Boolean = false; // When SWF visited directly with no parameters (or when security issue detected)
		//private var outgoing_lc = new LocalConnection ();
			if(debug || directAccess) {
				if(debug) {
					txLog.multiline = true;
					txLog.visible = false;
				} else if(directAccess) {
				}
				if(debug && directAccess) {
					txLog.visible = true;
					log("Direct Access");
			var i:Number = 0;
			for each (var s:String in p) {
				if(illegalChar(s)) {
					securityIssue = true; // Illegal char found
				i++;
			}
			if(i === 0 || securityIssue) {
				directAccess = true;
			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
						return true; // Illegal char found
			if((debug || directAccess) && stage.stageWidth > 20 && stage.stageHeight > 20) {
		public static const VERSION:String = "2.3.0"; // The version of the Flash jPlayer entity.
 * Version: 2.3.0
 * Date: 20th April 2013
			script: "2.3.0",
			needFlash: "2.3.0",
  "version": "2.3.0",

Fixed code:
 * Version: 2.3.1
 * Date: 14th May 2013
		private var securityIssue:Boolean = false; // On direct access and when SWF parameters contain illegal characters

				// The jQuery param is the primary cause of security concerns.
			if(debug || securityIssue) {
				txLog.multiline = true;
				if(securityIssue) {
				} else if(debug) {
					txLog.visible = false;
			// Check for direct access. Inspired by mediaelement.js - Also added name to object for non-IE browsers.
			if(ExternalInterface.objectID != null && ExternalInterface.objectID.toString() != "") {
				for each (var s:String in p) {
					if(illegalChar(s) || illegalWord(s)) {
						securityIssue = true; // Found a security concern.
					}
			} else {
				securityIssue = true; // Direct access disables the callbacks, which were a security concern.
			// A whitelist of accepted chars.
			var validParam:RegExp = /^[-A-Za-z0-9_.]+$/;
			return !validParam.test(s);
		}
		private function illegalWord(s:String):Boolean {
			// A blacklist of JavaScript commands that are a security concern.
			var illegals:String = "eval document alert confirm prompt console";
						return true; // Illegal word found
			if((debug || securityIssue) && stage.stageWidth > 20 && stage.stageHeight > 20) {
		public static const VERSION:String = "2.3.1"; // The version of the Flash jPlayer entity.
 * Version: 2.3.1
 * Date: 14th May 2013
			script: "2.3.1",
			needFlash: "2.3.1",
					htmlObj.setAttribute("name", this.internal.flash.id);
  "version": "2.3.1",