GitHub Advisoryadvisory · Packagist

GHSA-j6c3-3c4w-qv8p Moodle cross-site scripting (XSS) vulnerabilities

MEDIUM Published 2022-05-13 Modified 2024-01-23 Official page ↗
Aliases
CVE-2013-7341
Ecosystem
Packagist
Packages
moodle/moodle, typo3/cms
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-23

Affected packages

• Packagist moodle/moodle: < 2.4.9 → fixed in 2.4.9 • Packagist moodle/moodle: >= 2.5.0, < 2.5.5 → fixed in 2.5.5 • Packagist moodle/moodle: >= 2.6.0, < 2.6.2 → fixed in 2.6.2 • Packagist typo3/cms: >= 6.2.0, < 6.2.14 → fixed in 6.2.14 • Packagist typo3/cms: >= 7.0.0, < 7.3.1 → fixed in 7.3.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.

Related

Alias · CVE (1)

  • CVE-2013-7341 Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References