Skip to content
OpenAdvisories
Medium FSA-202301 1 CVE

Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance

Published Aug 29, 2023 · Updated Oct 1, 2025 · Revision 2

Vendor: Festo Product: LX Appliance

Summary

A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account (i.e., with the "Teacher" role), to craft a malicious course and launch an XSS attack.

Details

Contact Festo Didactic services department at services.didactic@festo.com to update your LX Appliance to the latest version.

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-23414

    Cross-site Scripting (XSS)

    This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

    video.js npm

Revision history

  1. #1.0.1

    Adjusted to VDE template. Changed title from "Video.js Cross-Site-Scripting (XSS) vulnerability in LX Appliance" to "Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance".

  2. #1.0.0

    Initial revision.

References