A vulnerability was found in RealNetworks RealPlayer 20.0.8.310 (Multimedia Player Software) and classified as problematic. This issue affects an unknown functionality of the component DCP URI Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. An attacker might be able to inject arbitrary html and script code into the web site. This would alter the appearance and would make it possible to initiate further attacks against site visitors. The summary by CVE is:

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary local files.

The weakness was shared 06/03/2022. The advisory is shared at github.com. The identification of this vulnerability is CVE-2022-32271 since 06/03/2022. The exploitation is known to be easy. The attack may be initiated remotely. The successful exploitation needs a simple authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/06/2022). It is expected to see the exploit prices for this product decreasing in the near future.MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Type

• Multimedia Player Software

Vendor

• RealNetworks

Name

• RealPlayer

CPE 2.3infoedit

• 🔒

CPE 2.2infoedit

• 🔒

Videoedit

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments