Moderate severityNVD Advisory· Published Aug 17, 2013· Updated Apr 29, 2026

CVE-2013-2022

Description

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
jplayernpm	< 2.3.0	2.3.0

Affected products

Happyworm/Jplayer69 versions
cpe:2.3:a:happyworm:jplayer:*:*:*:*:*:*:*:*+ 68 more
- cpe:2.3:a:happyworm:jplayer:*:*:*:*:*:*:*:*range: <=2.2.22
- cpe:2.3:a:happyworm:jplayer:0.2.1:beta:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:0.2.2:beta:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:0.2.3:beta:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:0.2.4:beta:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:0.2.5:beta:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.27:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.29:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.30:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.31:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.33:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.34:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.35:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.0.36:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.18:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.19:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.20:*:*:*:*:*:*:*
- cpe:2.3:a:happyworm:jplayer:2.2.21:*:*:*:*:*:*:*

Patches

c5fe17bb4459

Security Fox of Flash SWF that had enabled Cross Site Scripting (XSS)

https://github.com/happyworm/jPlayerHappywormApr 12, 2013via ghsa

commit

4 files changed · +6 −6

actionscript/happyworm/jPlayer/JplayerStatus.as+1 −1 modified

@@ -14,7 +14,7 @@
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()

actionscript/Jplayer.as+1 −1 modified

@@ -239,7 +239,7 @@ package {
 			}
 		}
 		private function illegalChar(s:String):Boolean {
-			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
+			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
 			if(Boolean(s)) { // Otherwise exception if parameter null.
 				for each (var illegal:String in illegals.split(' ')) {
 					if(s.indexOf(illegal) >= 0) {

jquery.jplayer/Jplayer.swf+0 −0 modified

jquery.jplayer/jquery.jplayer.js+4 −4 modified

@@ -8,8 +8,8 @@
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.22
- * Date: 29th March 2013
+ * Version: 2.2.23
+ * Date: 12th April 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
@@ -454,8 +454,8 @@
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.2.22",
-			needFlash: "2.2.20",
+			script: "2.2.23",
+			needFlash: "2.2.23",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor

c5fe17bb4459

Security Fox of Flash SWF that had enabled Cross Site Scripting (XSS)

https://github.com/jplayer/jPlayerHappywormApr 12, 2013via ghsa

commit

4 files changed · +6 −6

actionscript/happyworm/jPlayer/JplayerStatus.as+1 −1 modified

@@ -14,7 +14,7 @@
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()

actionscript/Jplayer.as+1 −1 modified

@@ -239,7 +239,7 @@ package {
 			}
 		}
 		private function illegalChar(s:String):Boolean {
-			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
+			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
 			if(Boolean(s)) { // Otherwise exception if parameter null.
 				for each (var illegal:String in illegals.split(' ')) {
 					if(s.indexOf(illegal) >= 0) {

jquery.jplayer/Jplayer.swf+0 −0 modified

jquery.jplayer/jquery.jplayer.js+4 −4 modified

@@ -8,8 +8,8 @@
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.22
- * Date: 29th March 2013
+ * Version: 2.2.23
+ * Date: 12th April 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
@@ -454,8 +454,8 @@
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.2.22",
-			needFlash: "2.2.20",
+			script: "2.2.23",
+			needFlash: "2.2.23",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-3jcq-cwr7-6332ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2013-2022ghsaADVISORY
marc.infonvdWEB
marc.infonvdWEB
marc.infonvdWEB
seclists.org/fulldisclosure/2013/Apr/192nvdWEB
www.jplayer.org/2.3.0/release-notesghsaWEB
www.openwall.com/lists/oss-security/2013/06/27/7nvdWEB
www.openwall.com/lists/oss-security/2013/07/04/5nvdWEB
github.com/happyworm/jPlayer/commit/c5fe17bb4459164bd59153b57248cf94b8867373nvdWEB
github.com/jplayer/jPlayer/commit/c5fe17bb4459164bd59153b57248cf94b8867373ghsaWEB
www.jplayer.org/2.3.0/release-notes/nvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000