CVE-2009-2011

2009-06-1621:00:00

CWE-78

[email protected]

web.nvd.nist.gov

cve-2009-2011

worldweaver dx studio player

remote code execution

javascript api

firefox plugin

7.4 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.885 High

EPSS

Percentile

98.7%

JSON

Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.

CPENameOperatorVersion
dxstudio:dx_studio_playerdxstudio dx studio playerle3.0.29.0
dxstudio:dx_studio_playerdxstudio dx studio playereq3.0.12.0
dxstudio:dx_studio_playerdxstudio dx studio playereq3.0.22.0

CPE	Name	Operator	Version
dxstudio:dx_studio_player	dxstudio dx studio player	le	3.0.29.0
dxstudio:dx_studio_player	dxstudio dx studio player	eq	3.0.12.0
dxstudio:dx_studio_player	dxstudio dx studio player	eq	3.0.22.0