Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

CERT/CC Vulnerability Notes ()2 · 1 read
Read at kb.cert.org
AI summary · glm-5.3-flashSummaries by Vani AI

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

Key facts
  • Same insecure deserialization flaw enables both arbitrary file read and RCE
  • Affected versions: html5lib v2.45, v2.103 and earlier, and other v2.x releases
  • Only legacy Player V2 is vulnerable; supported Player V7 is not affected
  • Tracked by CERT/CC as VU#308749
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
arbitrary-file-readhtml5-playerinsecure-deserializationkalturamwembedremote-code-execution
Vendors
KalturaCERT/CC
Products
Kaltura HTML5 Player V2Kaltura Player V7

From the original article

Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2. 45, v2.

CERT/CC Vulnerability Notes

kb.cert.org

Read the full article at CERT/CC Vulnerability Notes

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.