Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-06-16T20:26:00

Updated: 2024-08-07T05:36:20.196Z

Reserved: 2009-06-08T00:00:00

Link: CVE-2009-2011

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2009-06-16T21:00:00.390

Modified: 2024-02-14T01:17:43.863

Link: CVE-2009-2011

cve-icon Redhat

No data.