Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

MediaFront OSM Player lets attackers add malicious scripts

CVE-2012-1647 · published 14 years ago
Summary

The MediaFront module for Drupal includes a small PHP program for the OSM Player that does not properly clean up certain web inputs. An attacker could trick a user into running unwanted code in their browser, potentially stealing data or hijacking the session. Update MediaFront to version 6.x-1.5 or 7.x-1.5, or apply the vendor's patch, to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mediafront mediafront 6.x-1.0
6.x-1.0-beta3
6.x-1.1
6.x-1.2
6.x-1.3
6.x-1.x
cpe:2.3:a:mediafront:mediafront:6.x-1.0:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for D...
Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published28 Aug 2012
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-1647 · NVD
Track software like this
Free during beta