Is CVE-2016-4567 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-4567 being exploited in the wild.

How severe is CVE-2016-4567?

Low severity, with a CVSS score of 3, published 17 May 2022.

Which products and versions are affected?

Contao 3.0.0 - 3.5.14; John Dyer MediaElement.js < 2.21.0; mediaelement (npm) SEMVER:introduced=0,fixed=2.11.1; contao-components/mediaelement (Packagist) ECOSYSTEM:introduced=2.14.2,fixed=2.21.1; and 2 more.

Is there a fix for CVE-2016-4567?

Yes. mediaelement (npm): upgrade to 2.11.1 or later; contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later; contao/core (Packagist): upgrade to 3.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-4567 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-4567?

Check whether you run Contao, John Dyer MediaElement.js, mediaelement (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-4567: MediaElement.js Reflected XSS in FlashMediaElement component

Q: Is there a fix for CVE-2016-4567?

Yes. mediaelement (npm): upgrade to 2.11.1 or later; contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later; contao/core (Packagist): upgrade to 3.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2016-4567 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2016-4567?

Check whether you run Contao, John Dyer MediaElement.js, mediaelement (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-4567 · Severity: low · CVSS 3 · Published 2022-05-17

MediaElement.js is a popular media player library used by content management systems like WordPress and Contao to handle video and audio. A security flaw in its Flash component allows attackers to perform 'Reflected Cross-Site Scripting' (XSS) by tricking a user into clicking a malicious link. If successful, an attacker could execute unauthorized scripts in the user's browser, potentially leading to the theft of session cookies, account takeover, or the defacement of the website.

Technologies: Contao, contao/core (Packagist), Wordpress. Vendors: Contao, npm, Packagist, Wordpress.

Quick answers

Is CVE-2016-4567 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-4567 being exploited in the wild.
How severe is CVE-2016-4567?: Low severity, with a CVSS score of 3, published 17 May 2022.
Which products and versions are affected?: Contao 3.0.0 - 3.5.14; John Dyer MediaElement.js < 2.21.0; mediaelement (npm) SEMVER:introduced=0,fixed=2.11.1; contao-components/mediaelement (Packagist) ECOSYSTEM:introduced=2.14.2,fixed=2.21.1; and 2 more.
Is there a fix for CVE-2016-4567?: Yes. mediaelement (npm): upgrade to 2.11.1 or later; contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later; contao/core (Packagist): upgrade to 3.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-4567 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-4567?: Check whether you run Contao, John Dyer MediaElement.js, mediaelement (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediaelement (npm): upgrade to 2.11.1 or later
```
npm install mediaelement@2.11.1
```
contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later
```
composer require contao-components/mediaelement:^2.21.1
```
contao/core (Packagist): upgrade to 3.5.15 or later
```
composer require contao/core:^3.5.15
```

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the 'flash/FlashMediaElement.as' (and compiled .swf) component of MediaElement.js. The root cause is an ineffective sanitization routine that attempts to strip GET parameters from 'flashVars' to prevent external manipulation of 'ExternalInterface' calls. Attackers can bypass this protection using an obfuscated parameter name (e.g., 'jsinitfunctio%gn') to inject arbitrary JavaScript. This vulnerability was widely distributed via its inclusion in WordPress (versions 4.2 through 4.5.1) and Contao. Exploitation requires a victim to visit a specially crafted URL. The issue is resolved in MediaElement.js version 2.21.0 and later.

Affected products

John Dyer MediaElement.js < 2.21.0
WordPress WordPress 4.2 - 4.5.1
Contao Contao 3.0.0 - 3.5.14

Identifiers

CVE-2016-4567
GHSA-277w-qpxr-2549

Timeline

2016-04-01: disclosed: Reported to WordPress via HackerOne by Cure53 team
2016-05-06: patched: WordPress 4.5.2 released with fix
2016-05-17: advisory: GitHub Advisory published
2016-07-15: patched: Contao 3.5.15 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.