What is CVE-2013-2204?

CVE-2013-2204 is a vulnerability in Tinymce Media, classified under Improper Input Validation. Published 2013-07-08.

Is CVE-2013-2204 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Tinymce Media

CVE-2013-2204

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.029 (85.5th percentile) — read the EPSS interpretation.

Affected products

Tinymce Media
Wordpress — versions 0.71, 1.0, 1.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

20142995/nuclei-templates

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)

Frequently asked questions

What is CVE-2013-2204?: CVE-2013-2204 is a vulnerability in Tinymce Media, classified under Improper Input Validation. Published 2013-07-08.
Is CVE-2013-2204 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.