Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2009-06-16T20:26:00
Updated: 2024-08-07T05:36:20.196Z
Reserved: 2009-06-08T00:00:00
Link: CVE-2009-2011
Vulnrichment
No data.
NVD
Status : Modified
Published: 2009-06-16T21:00:00.390
Modified: 2024-02-14T01:17:43.863
Link: CVE-2009-2011
Redhat
No data.