Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in…
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
Why it matters now
EPSS 0.07274 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zeroclipboard_project:zeroclipboard:*:*:*:*:*:*:*:* | up to 1.0.7 | Vulnerable | Zeroclipboard Project |
| cpe:2.3:a:zeroclipboard_project:zeroclipboard:1.0.5:*:*:*:*:*:*:* | 1.0.5 | Vulnerable | Zeroclipboard Project |
- cpe:2.3:a:zeroclipboard_project:zeroclipboard:*:*:*:*:*:*:*:* Versions up to 1.0.7 Vulnerable ·Zeroclipboard Project
- cpe:2.3:a:zeroclipboard_project:zeroclipboard:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Zeroclipboard Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHOSE Client 1.2 | Fixed | — |
| RHOSE Infrastructure 1.2 | Fixed | — |
| Red Hat OpenShift Enterprise Node | Fixed | — |
Not affected: 1 product
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1808
- 2026-10-03 Alias added: GHSA-rxmh-jwx2-vgrr
References
Exploit 2
Other 13
- https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb
- [oss-security] 20130326 Re: WordPress plugins vulnerable to CVE-2013-1808
- 20130218 XSS vulnerabilities in ZeroClipboard
- 20130220 XSS vulnerabilities in YAML, Multiproject for Trac, UserCollections for Piwigo, TAO and TableTools for DataTables for jQuery
- http://securityvulns.ru/docs29105.html
- [oss-security] 20130302 Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf
- 20130301 XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS
- 20130418 XSS vulnerabilities in ZeroClipboard in multiple plugins for WordPress
- http://securityvulns.ru/docs29103.html
- https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108
- 20130409 XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress
- [oss-security] 20130324 XSS vulnerabilities in ZeroClipboard and multiple web applications
More Zeroclipboard Project Zeroclipboard vulnerabilities
- TI-2012-05268 Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote… CVSS 2.0MEDIUM 4.3
- TI-2014-01457 Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2013-1808 · CVE Program
- CVE-2013-1808 · NVD
- FIRST EPSS
- GHSA-rxmh-jwx2-vgrr · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1808 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences