{"id":"CVE-2022-4882","summary":"kaltura mwEmbed Share Plugin share.js cross site scripting","details":"A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.","modified":"2026-10-28T02:30:52.158545340Z","published":"2023-01-09T08:50:13.062Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4882.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"2.2"},{"last_affected":"2.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4882.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4882"},{"type":"ADVISORY","url":"https://vuldb.com/?id.217664"},{"type":"REPORT","url":"https://github.com/kaltura/mwEmbed/pull/4255"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.217664"},{"type":"FIX","url":"https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845"},{"type":"FIX","url":"https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kaltura/mwembed","events":[{"introduced":"ef162d10cb3bef8f36e0f1dc30afff33b8abf6e2"},{"fixed":"4f11b6f6610acd6d89de5f8be47cf7c610643845"},{"fixed":"b854b16226128036448816ca9cc6ee8de45622a4"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.0"},{"last_affected":"2.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.1"},{"last_affected":"2.1"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.3"},{"last_affected":"2.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.4"},{"last_affected":"2.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.5"},{"last_affected":"2.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.6"},{"last_affected":"2.6"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.7"},{"last_affected":"2.7"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.8"},{"last_affected":"2.8"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.9"},{"last_affected":"2.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.10"},{"last_affected":"2.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.11"},{"last_affected":"2.11"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.12"},{"last_affected":"2.12"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.13"},{"last_affected":"2.13"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.14"},{"last_affected":"2.14"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.15"},{"last_affected":"2.15"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.16"},{"last_affected":"2.16"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.17"},{"last_affected":"2.17"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.18"},{"last_affected":"2.18"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.19"},{"last_affected":"2.19"}]},{"range":[{"introduced":"2.20"},{"last_affected":"2.20"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.21"},{"last_affected":"2.21"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.22"},{"last_affected":"2.22"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.23"},{"last_affected":"2.23"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.24"},{"last_affected":"2.24"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.25"},{"last_affected":"2.25"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.26"},{"last_affected":"2.26"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.27"},{"last_affected":"2.27"}]},{"range":[{"introduced":"2.28"},{"last_affected":"2.28"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.29"},{"last_affected":"2.29"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.30"},{"last_affected":"2.30"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.31"},{"last_affected":"2.31"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.32"},{"last_affected":"2.32"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.33"},{"last_affected":"2.33"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.34"},{"last_affected":"2.34"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.35"},{"last_affected":"2.35"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.36"},{"last_affected":"2.36"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.37"},{"last_affected":"2.37"}]},{"range":[{"introduced":"2.38"},{"last_affected":"2.38"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.39"},{"last_affected":"2.39"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.40"},{"last_affected":"2.40"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.41"},{"last_affected":"2.41"}]},{"range":[{"introduced":"2.42"},{"last_affected":"2.42"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.43"},{"last_affected":"2.43"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.44"},{"last_affected":"2.44"}]},{"range":[{"introduced":"2.45"},{"last_affected":"2.45"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.46"},{"last_affected":"2.46"}]},{"range":[{"introduced":"2.47"},{"last_affected":"2.47"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.48"},{"last_affected":"2.48"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.49"},{"last_affected":"2.49"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.50"},{"last_affected":"2.50"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.51"},{"last_affected":"2.51"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.52"},{"last_affected":"2.52"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.53"},{"last_affected":"2.53"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.54"},{"last_affected":"2.54"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.55"},{"last_affected":"2.55"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.56"},{"last_affected":"2.56"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.57"},{"last_affected":"2.57"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.58"},{"last_affected":"2.58"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.59"},{"last_affected":"2.59"}]},{"range":[{"introduced":"2.60"},{"last_affected":"2.60"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.61"},{"last_affected":"2.61"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.62"},{"last_affected":"2.62"}]},{"range":[{"introduced":"2.63"},{"last_affected":"2.63"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.64"},{"last_affected":"2.64"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.65"},{"last_affected":"2.65"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.66"},{"last_affected":"2.66"}]},{"range":[{"introduced":"2.67"},{"last_affected":"2.67"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.68"},{"last_affected":"2.68"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.69"},{"last_affected":"2.69"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.70"},{"last_affected":"2.70"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.71"},{"last_affected":"2.71"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.72"},{"last_affected":"2.72"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.73"},{"last_affected":"2.73"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.74"},{"last_affected":"2.74"}]},{"range":[{"introduced":"2.75"},{"last_affected":"2.75"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.76"},{"last_affected":"2.76"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.77"},{"last_affected":"2.77"}]},{"range":[{"introduced":"2.78"},{"last_affected":"2.78"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.79"},{"last_affected":"2.79"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.80"},{"last_affected":"2.80"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.81"},{"last_affected":"2.81"}]},{"range":[{"introduced":"2.82"},{"last_affected":"2.82"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.83"},{"last_affected":"2.83"}]},{"range":[{"introduced":"2.84"},{"last_affected":"2.84"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.85"},{"last_affected":"2.85"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.86"},{"last_affected":"2.86"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.87"},{"last_affected":"2.87"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.88"},{"last_affected":"2.88"}]},{"range":[{"introduced":"2.89"},{"last_affected":"2.89"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.90"},{"last_affected":"2.90"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.91"},{"last_affected":"2.91"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"4f11b6f6610acd6d89de5f8be47cf7c610643845"}]},{"source":"REFERENCES_TAG","original_tag":"v2.92.rc1","range":[{"fixed":"b854b16226128036448816ca9cc6ee8de45622a4"}]}]}}],"versions":["2.0","2.1","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.19","2.20","2.21","2.22","2.23","2.24","2.25","2.26","2.27","2.28","2.29","2.3","2.30","2.31","2.32","2.33","2.34","2.35","2.36","2.37","2.38","2.39","2.4","2.40","2.41","2.42","2.43","2.44","2.45","2.46","2.47","2.48","2.49","2.5","2.50","2.51","2.52","2.53","2.54","2.55","2.56","2.57","2.58","2.59","2.6","2.60","2.61","2.62","2.63","2.64","2.65","2.66","2.67","2.68","2.69","2.7","2.70","2.71","2.72","2.73","2.74","2.75","2.76","2.77","2.78","2.79","2.8","2.80","2.81","2.82","2.83","2.84","2.85","2.86","2.87","2.88","2.89","2.9","2.90","2.91"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4882.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"}]}