CVE-2013-2204

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a…

published July 8, 2013

CVSS
—
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02904 · 86.9th percentile
Published
2013-07-08T20:00Z
EPSS history
Timeline
  • 08 JUL 20:00Z
    moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a…
    cvelistv5