PT-2013-3594 · Moxiecode · Moxieplayer

Published 2013-07-01 · Updated 2013-08-13 · CVE-2013-2204

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moxiecode moxieplayer versions prior to 3.5.2

Description The issue allows remote attackers to pass arbitrary parameters to a Flash application and conduct content-spoofing attacks by crafting a string after a ? (question mark) character, due to the failure to consider the presence of a # (pound sign) character during extraction of the QUERY STRING.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Flash application to minimize the risk of exploitation. Avoid using the QUERY STRING parameter in the affected application until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-2204

DSA-2718-1

MGASA-2013-0198

Affected Products

Moxieplayer

References · 14

• 🔥❌ https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2dcf2f3f37dbfab0 · Exploit, Deleted
• http://wordpress.org/news/2013/06/wordpress-3-5-2 · Vendor Advisory
• http://debian.org/security/2013/dsa-2718 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0198.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2204 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2204 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2204 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=10596 · Note
• http://codex.wordpress.org/Version_3.5.2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=976784 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2204 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=973254 · Note