The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating.

The VLC media player install on the remote host is affected by a cross-site scripting vulnerability because it fails to sanitize input passed via XML services in the web interface. 

Note that the install is likely to be affected by additional vulnerabilities as well, although Nessus has not tested for these issues.

The web interface for VLC media player listening on the remote host does not require authentication, which allows an unauthenticated remote attacker to issue XML service commands via the VLC Web Interface.

The version of VLC media player installed on the remote host is earlier than 2.0.7 and is, therefore, affected by the following vulnerabilities:

  - The web interface contains a flaw that does not validate     input passed via XML services resulting in a cross-site     scripting vulnerability.

  - A flaw exists in the XML services of the web interface     that may allow a remote attacker to execute media player     commands.

  - A flaw exists that could lead to a denial of service /     memory consumption when loading a malicious playlist.

ID	Name	Product	Family	Severity
69018	VLC Web Interface XML Services XSS	Nessus	CGI abuses : XSS	medium
69017	VLC Web Interface XML Services Remote Command Execution	Nessus	CGI abuses	medium
69015	VLC < 2.0.7 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2013-3564

medium

Tenable Plugins

medium

medium

medium