CVE-2013-2204

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.90% chance of exploitation in the next 30 days, 86th percentile

Nuclei

medium

Published

2013-07-08

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2013/CVE-2013-2204-wordpress-7e…

References

• CVE Record
• NVD entry

Related

• CVE-2013-2203
• CVE-2013-2205
• CVE-2013-2202
• CVE-2013-2218
• CVE-2013-2201
• CVE-2013-2225