CVE-2013-2204: Input Validation
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERYSTRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2204?
CVE-2013-2204 is categorized as having a moderate severity level.
How do I fix CVE-2013-2204?
To fix CVE-2013-2204, update your WordPress installation to version 3.5.2 or later.
What products are affected by CVE-2013-2204?
CVE-2013-2204 affects WordPress versions prior to 3.5.2 and the TinyMCE Media plugin.
Can exploiting CVE-2013-2204 lead to remote code execution?
Yes, exploiting CVE-2013-2204 allows attackers to pass arbitrary parameters to a Flash application potentially leading to unauthorized actions.
Is there a workaround for CVE-2013-2204?
A recommended workaround for CVE-2013-2204 is to disable the TinyMCE Media plugin until the software can be updated.