Description
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | db4o | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | ImageMagick +3 | 6.5.4.7-6.el6_2 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | atlas +1 | 3.8.4-2.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | facter | 1.6.6-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | gd +1 | 2.0.35-11.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | gdbm +1 | 1.8.0-36.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | geos +1 | 3.3.1-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ghostscript +2 | 8.70-15.el6_4.1 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | haproxy | 1.4.22-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | jasper +1 | 1.900.1-15.el6_1.1 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | jboss-eap6-index | 6.0.0.GA-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | jboss-eap6-modules | 6.0.0.GA-8.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | jenkins | 1.509.1-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | jenkins-plugin-openshift | 0.6.19-0.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | js +1 | 1.70-12.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | lapack +2 | 3.2.1-4.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | lcms +1 | 1.19-1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | libc-client +1 | 2007e-11.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | libcgroup +1 | 0.37-7.2.el6_4 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | libmcrypt +1 | 2.5.8-10.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | maven3 | 3.0.3-4 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | mod_passenger +5 | 3.0.17-2.el6op.1 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs | 0.6.20-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-async | 0.1.16-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-commander | 0.6.1-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-mkdirp | 0.3.0-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-optimist | 0.3.5-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-options | 0.0.3-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-supervisor | 0.4.1-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-tinycolor | 0.0.1-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-wordwrap | 0.0.2-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | nodejs-ws | 0.4.22-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-cron | 1.7.6-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-cron-1.4 | 1.9.1-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-diy +1 | 0.4.8-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-haproxy | 0.4.10-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins | 1.9.8-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins-client | 1.8.6-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-mock +1 | 0.4.7-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-mock-plugin | 0.4.5-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-mysql | 0.3.7-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-perl | 0.4.8-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-php +1 | 0.4.9-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-postgresql | 0.2.7-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-msg-node-mcollective | 1.9.3-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-node-proxy | 0.9.2-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-node-util | 1.9.9-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | openshift-origin-port-proxy | 1.6.4-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | pam_openshift | 1.6.1-1.1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-App-cpanminus | 1.4008-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-Accessor | 0.31-6.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-DBI | 3.0.17-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-DBI-Pg | 0.09-9.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-Data-Inheritable | 0.08-3.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-Factory-Util | 1.7-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Class-Trigger | 0.13-2.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Clone | 0.31-3.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-DBIx-ContextualFetch | 1.03-7.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-DateTime-Format-Builder | 0.7901-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-DateTime-Format-Pg | 0.16004-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-DateTime-Format-Strptime | 1.1000-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-IO-stringy | 2.110-10.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-Ima-DBI | 0.35-7.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-JSON | 2.15-5.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-UNIVERSAL-moniker | 0.08-9.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | perl-YAML | 0.70-4.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php +5 | 5.3.3-22.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-extras +1 | 5.3.3-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-pear-MDB2 | 2.5.0-0.3.b3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-pear-MDB2-Driver-pgsql | 1.5.0-0.1.b3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-pecl-imagick | 2.2.2-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-pecl-xdebug | 2.1.4-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | php-php-gettext | 1.0.11-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | postgis +1 | 1.5.3-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | postgresql-ip4r | 1.05-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | proj +1 | 4.7.0-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | python-virtualenv | 1.7-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby-RMagick +1 | 2.13.1-6.el6op.1 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby-mysql | 2.8.2-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby-nokogiri +2 | 1.4.3.1-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby-sqlite3 +2 | 1.3.3-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-facter | 1.6.6-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-js +1 | 1:1.8.5-10.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-ruby-mysql | 2.8.2-8.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-ruby-selinux | 2.0.94-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-ZenTest +1 | 4.8.1-1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-bacon +1 | 1.1.0-8.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-bcrypt-ruby | 3.0.1-7.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-commander | 4.0.3-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-daemon_controller +1 | 1.1.0-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-daemons | 1.0.10-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-fakeweb +1 | 1.3.0-8.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-fastthread | 1.0.7-7.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-highline | 1.6.16-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-http_connection | 1.4.1-7.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-introspection +1 | 0.0.2-7.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-json_pure +1 | 1.7.3-1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-metaclass +1 | 0.0.1-8.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-mocha +1 | 0.12.10-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-pg +1 | 0.12.2-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-rspec | 2.11.0-2.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-rspec-core +3 | 2.11.1-1 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-rspec-expectations +1 | 2.11.1-2 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-ruby2ruby +1 | 1.3.1-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-ruby_parser +1 | 2.3.1-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-sinatra +1 | 1:1.3.2-11.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-sqlite3 +1 | 1.3.6-1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | ruby193-rubygem-test_declarative +1 | 0.0.5-3.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-ParseTree +1 | 3.0.5-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-RubyInline +1 | 3.8.4-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-ZenTest +1 | 4.3.3-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-bson +2 | 1.8.3-1.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-builder | 2.1.2-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-bundler +1 | 1.0.21-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-diff-lcs | 1.1.2-5.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-fastthread | 1.0.7-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-open4 +1 | 1.3.0-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-node | 1.9.13-1.2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-rack | 1:1.3.0-4.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-rake | 0.8.7-2.1.el6 | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-ruby2ruby +1 | 1.2.4-3.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-ruby_parser +1 | 2.0.4-6.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-sexp_processor +1 | 3.0.4-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-thor +1 | 0.14.6-2.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | rubygem-thread-dump | 0.0.5-93.el6op | RHEA-2013:1032 |
| Red Hat OpenShift 1 | uuid +2 | 1.6.1-10.el6 | RHEA-2013:1032 |
Advisories 1
- RHEA-2013:1032 Red Hat Enhancement Advisory: Red Hat OpenShift Enterprise 1.2 Node Release Advisory Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb
- [oss-security] 20130326 Re: WordPress plugins vulnerable to CVE-2013-1808 mailing-list
- 20130218 XSS vulnerabilities in ZeroClipboard mailing-list
- 20130220 XSS vulnerabilities in YAML, Multiproject for Trac, UserCollections for Piwigo, TAO and TableTools for DataTables for jQuery mailing-list
- http://securityvulns.ru/docs29105.html
- [oss-security] 20130302 Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf mailing-list
- 20130301 XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS mailing-list
- 20130418 XSS vulnerabilities in ZeroClipboard in multiple plugins for WordPress mailing-list
- http://securityvulns.ru/docs29103.html
- http://securityvulns.ru/docs29104.html
- https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108
- [oss-security] 20130310 WordPress plugins vulnerable to CVE-2013-1808 mailing-list
- 20130409 XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress mailing-list
- [oss-security] 20130324 XSS vulnerabilities in ZeroClipboard and multiple web applications mailing-list
- 58257 vdb-entry