CVE-2009-2011

Name of the Vulnerable Software and Affected Versions: Worldweaver DX Studio Player versions prior to 3.0.29.1

Description: The issue allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes the shell.execute JavaScript API method, due to a lack of access restriction to this method when the player is used as a plug-in for Firefox.

Recommendations: For versions prior to 3.0.29.1, consider disabling the shell.execute JavaScript API method as a temporary workaround until a patch is available. Restrict access to .dxstudio files that may invoke this method to minimize the risk of exploitation.