Miggo Logo
Miggo Vulnerability Database
→
GHSA-8c85-4rr5-chr4

GHSA-8c85-4rr5-chr4: Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-8c85-4rr5-chr4
EPSS Score
-
CWE
-
Published
5/15/2024
Updated
5/15/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
ezsystems/demobundlecomposer>= 5.4.0, < 5.4.6.15.4.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The advisory explicitly states the vulnerability stems from an outdated VideoJS Flash-based player (video-js.swf file) but provides no specific function-level details. The resolution was file removal rather than patching specific functions. Without access to: 1) The exact vulnerable VideoJS version's source code, 2) Commit diffs showing vulnerable code patterns, or 3) XSS payload reproduction details, we cannot confidently identify specific vulnerable functions. The vulnerability appears to reside in the Flash player's handling of external inputs, but Flash/AS3 reverse-engineering would be required to pinpoint exact functions - information not provided in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*is S**urity **visory is **out * vuln*r**ility in Vi**oJS, w*i** is *un*l** in **mo*un*l* *n* t** *z**mo l****y *xt*nsion. Ol**r r*l**s*s o* Vi**oJS *ont*in *n XSS vuln*r**ility in t** *l*s*-**s** vi**o pl*y*r. T*is is *un*l** in **mo*un*l*, *n* in

Reasoning

T** **visory *xpli*itly st*t*s t** vuln*r**ility st*ms *rom *n out**t** `Vi**oJS` *l*s*-**s** pl*y*r (`vi**o-js.sw*` *il*) *ut provi**s no sp**i*i* `*un*tion-l*v*l` **t*ils. T** r*solution w*s *il* r*mov*l r*t**r t**n p*t**in* sp**i*i* `*un*tions`. W