CVE-2017-6391: Kaltura Server

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Affected products

• Kaltura Kaltura Server: up to and including lynx-12.11.0

Published 2017-03-02. Last modified 2026-06-17.