VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers
Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.
CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.
50