CVE-2013-2204
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers…
Does this matter?
Lower severity and a low EPSS score (2.90%). Track it; it rarely justifies an emergency change on its own.
Description
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.90% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- tinymce/media · wordpress/wordpress
- Source
- secalert@redhat.com
References
- http://codex.wordpress.org/Version_3.5.2
- http://wordpress.org/news/2013/06/wordpress-3-5-2/Vendor Advisory
- http://www.debian.org/security/2013/dsa-2718
- https://bugzilla.redhat.com/show_bug.cgi?id=976784
- https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2dcf2f3f37dbfab0Exploit, Patch
- http://codex.wordpress.org/Version_3.5.2
- http://wordpress.org/news/2013/06/wordpress-3-5-2/Vendor Advisory
- http://www.debian.org/security/2013/dsa-2718
- https://bugzilla.redhat.com/show_bug.cgi?id=976784
- https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2dcf2f3f37dbfab0Exploit, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.