CVE-2022-4876 Kaltura mwEmbed DefaultSettings.php cross site scripting

🗓️ 04 Jan 2023 22:02:54Reported by GoogleType

osv🔗 osv.dev👁 14 Views

A remote code execution vulnerability has been identified in Kaltura mwEmbed up to version 2.96.rc1, allowing for cross site scripting via manipulation of the HTTP_X_FORWARDED_HOST argument in the includes/DefaultSettings.php file. Upgrading to version 2.96.rc2 with patch 13b8812ebc8c9fa034eed91ab35ba8423a528c0b is advised

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-4876	5 Jan 202302:18	–	circl
CNNVD	Kaltura mwEmbed 跨站脚本漏洞	4 Jan 202300:00	–	cnnvd
CVE	CVE-2022-4876	4 Jan 202322:02	–	cve
Cvelist	CVE-2022-4876 Kaltura mwEmbed DefaultSettings.php cross site scripting	4 Jan 202322:02	–	cvelist
EUVD	EUVD-2022-52136	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4876	4 Jan 202323:15	–	nvd
Prion	Cross site scripting	4 Jan 202323:15	–	prion
Positive Technologies	PT-2023-15890 · Kaltura · Kaltura Mwembed	4 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4876	23 May 202500:24	–	redhatcve
Vulnrichment	CVE-2022-4876 Kaltura mwEmbed DefaultSettings.php cross site scripting	4 Jan 202322:02	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4876.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-4876
vuldb	www.vuldb.com/
github	www.github.com/kaltura/mwEmbed/pull/4266
vuldb	www.vuldb.com/
github	www.github.com/kaltura/mwEmbed/commit/13b8812ebc8c9fa034eed91ab35ba8423a528c0b
github	www.github.com/kaltura/mwEmbed/releases/tag/v2.96.rc2

15 Jul 2026 02:07Current

3.9Low risk

Vulners AI Score3.9

CVSS 3.13.5

EPSS0.0051