CVE-2013-7341 Moodle cross-site scripting (XSS) vulnerabilities
MediumCVSS 4.3
EPSS 2.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moodle/moodle(Packagist) | < 2.4.9 | 2.4.9 |
| moodle/moodle(Packagist) | = v2.3.10 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.11 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.4 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.5 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.6 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.7 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.8 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.9 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.0 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.0-rc1 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.1 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.2 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.3 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.4 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.5 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.6 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.7 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.8 | No fix listed |
| moodle/moodle(Packagist) | >= 2.5.0, < 2.5.5 | 2.5.5 |
| moodle/moodle(Packagist) | = v2.5.0 | No fix listed |
| moodle/moodle(Packagist) | = v2.5.1 | No fix listed |
| moodle/moodle(Packagist) | = v2.5.2 | No fix listed |
| moodle/moodle(Packagist) | = v2.5.3 | No fix listed |
| moodle/moodle(Packagist) | = v2.5.4 | No fix listed |
Show 117 more
| Product | Affected versions | Fixed in |
|---|---|---|
| moodle/moodle(Packagist) | >= 2.6.0, < 2.6.2 | 2.6.2 |
| moodle/moodle(Packagist) | = v2.6.0 | No fix listed |
| moodle/moodle(Packagist) | = v2.6.1 | No fix listed |
| typo3/cms(Packagist) | >= 6.2.0, < 6.2.14 | 6.2.14 |
| typo3/cms(Packagist) | = 6.2.0 | No fix listed |
| typo3/cms(Packagist) | = 6.2.1 | No fix listed |
| typo3/cms(Packagist) | = 6.2.10 | No fix listed |
| typo3/cms(Packagist) | = 6.2.10-rc1 | No fix listed |
| typo3/cms(Packagist) | = 6.2.11 | No fix listed |
| typo3/cms(Packagist) | = 6.2.12 | No fix listed |
| typo3/cms(Packagist) | = 6.2.13 | No fix listed |
| typo3/cms(Packagist) | = 6.2.2 | No fix listed |
| typo3/cms(Packagist) | = 6.2.3 | No fix listed |
| typo3/cms(Packagist) | = 6.2.4 | No fix listed |
| typo3/cms(Packagist) | = 6.2.5 | No fix listed |
| typo3/cms(Packagist) | = 6.2.6 | No fix listed |
| typo3/cms(Packagist) | = 6.2.7 | No fix listed |
| typo3/cms(Packagist) | = 6.2.8 | No fix listed |
| typo3/cms(Packagist) | = 6.2.9 | No fix listed |
| typo3/cms(Packagist) | >= 7.0.0, < 7.3.1 | 7.3.1 |
| typo3/cms(Packagist) | = 7.0.0 | No fix listed |
| typo3/cms(Packagist) | = 7.0.1 | No fix listed |
| typo3/cms(Packagist) | = 7.0.2 | No fix listed |
| typo3/cms(Packagist) | = 7.1.0 | No fix listed |
| typo3/cms(Packagist) | = 7.2.0 | No fix listed |
| typo3/cms(Packagist) | = 7.3.0 | No fix listed |
| flowplayer flash | <= 3.2.16 | No fix listed |
| flowplayer flash | = 3.0.0 | No fix listed |
| flowplayer flash | = 3.0.1 | No fix listed |
| flowplayer flash | = 3.0.2 | No fix listed |
| flowplayer flash | = 3.0.3 | No fix listed |
| flowplayer flash | = 3.0.4 | No fix listed |
| flowplayer flash | = 3.0.5 | No fix listed |
| flowplayer flash | = 3.0.6 | No fix listed |
| flowplayer flash | = 3.1.0 | No fix listed |
| flowplayer flash | = 3.1.1 | No fix listed |
| flowplayer flash | = 3.1.2 | No fix listed |
| flowplayer flash | = 3.1.3 | No fix listed |
| flowplayer flash | = 3.1.4 | No fix listed |
| flowplayer flash | = 3.1.5 | No fix listed |
| flowplayer flash | = 3.2.0 | No fix listed |
| flowplayer flash | = 3.2.1 | No fix listed |
| flowplayer flash | = 3.2.2 | No fix listed |
| flowplayer flash | = 3.2.3 | No fix listed |
| flowplayer flash | = 3.2.4 | No fix listed |
| flowplayer flash | = 3.2.5 | No fix listed |
| flowplayer flash | = 3.2.6 | No fix listed |
| flowplayer flash | = 3.2.7 | No fix listed |
| flowplayer flash | = 3.2.8 | No fix listed |
| flowplayer flash | = 3.2.9 | No fix listed |
| flowplayer flash | = 3.2.10 | No fix listed |
| flowplayer flash | = 3.2.11 | No fix listed |
| flowplayer flash | = 3.2.12 | No fix listed |
| flowplayer flash | = 3.2.13 | No fix listed |
| flowplayer flash | = 3.2.14 | No fix listed |
| flowplayer flash | = 3.2.15 | No fix listed |
| moodle/moodle | <= 2.3.11 | No fix listed |
| moodle/moodle | = 2.0.0 | No fix listed |
| moodle/moodle | = 2.0.1 | No fix listed |
| moodle/moodle | = 2.0.2 | No fix listed |
| moodle/moodle | = 2.0.3 | No fix listed |
| moodle/moodle | = 2.0.4 | No fix listed |
| moodle/moodle | = 2.0.5 | No fix listed |
| moodle/moodle | = 2.0.6 | No fix listed |
| moodle/moodle | = 2.0.7 | No fix listed |
| moodle/moodle | = 2.0.8 | No fix listed |
| moodle/moodle | = 2.0.9 | No fix listed |
| moodle/moodle | = 2.1.0 | No fix listed |
| moodle/moodle | = 2.1.1 | No fix listed |
| moodle/moodle | = 2.1.2 | No fix listed |
| moodle/moodle | = 2.1.3 | No fix listed |
| moodle/moodle | = 2.1.4 | No fix listed |
| moodle/moodle | = 2.1.5 | No fix listed |
| moodle/moodle | = 2.1.6 | No fix listed |
| moodle/moodle | = 2.1.7 | No fix listed |
| moodle/moodle | = 2.1.8 | No fix listed |
| moodle/moodle | = 2.1.9 | No fix listed |
| moodle/moodle | = 2.1.10 | No fix listed |
| moodle/moodle | = 2.2.0 | No fix listed |
| moodle/moodle | = 2.2.1 | No fix listed |
| moodle/moodle | = 2.2.2 | No fix listed |
| moodle/moodle | = 2.2.3 | No fix listed |
| moodle/moodle | = 2.2.4 | No fix listed |
| moodle/moodle | = 2.2.5 | No fix listed |
| moodle/moodle | = 2.2.6 | No fix listed |
| moodle/moodle | = 2.2.7 | No fix listed |
| moodle/moodle | = 2.2.8 | No fix listed |
| moodle/moodle | = 2.2.9 | No fix listed |
| moodle/moodle | = 2.2.10 | No fix listed |
| moodle/moodle | = 2.2.11 | No fix listed |
| moodle/moodle | = 2.3.0 | No fix listed |
| moodle/moodle | = 2.3.1 | No fix listed |
| moodle/moodle | = 2.3.2 | No fix listed |
| moodle/moodle | = 2.3.3 | No fix listed |
| moodle/moodle | = 2.3.4 | No fix listed |
| moodle/moodle | = 2.3.5 | No fix listed |
| moodle/moodle | = 2.3.6 | No fix listed |
| moodle/moodle | = 2.3.7 | No fix listed |
| moodle/moodle | = 2.3.8 | No fix listed |
| moodle/moodle | = 2.3.9 | No fix listed |
| moodle/moodle | = 2.3.10 | No fix listed |
| moodle/moodle | = 2.4.0 | No fix listed |
| moodle/moodle | = 2.4.1 | No fix listed |
| moodle/moodle | = 2.4.2 | No fix listed |
| moodle/moodle | = 2.4.3 | No fix listed |
| moodle/moodle | = 2.4.4 | No fix listed |
| moodle/moodle | = 2.4.5 | No fix listed |
| moodle/moodle | = 2.4.6 | No fix listed |
| moodle/moodle | = 2.4.7 | No fix listed |
| moodle/moodle | = 2.4.8 | No fix listed |
| moodle/moodle | = 2.5.0 | No fix listed |
| moodle/moodle | = 2.5.1 | No fix listed |
| moodle/moodle | = 2.5.2 | No fix listed |
| moodle/moodle | = 2.5.3 | No fix listed |
| moodle/moodle | = 2.5.4 | No fix listed |
| moodle/moodle | = 2.6.0 | No fix listed |
| moodle/moodle | = 2.6.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com exploit
- github.com product
- moodle.org
- typo3.org
- flash.flowplayer.org
- git.moodle.org
- [oss-security] 20140317 Moodle security notifications public mailing-list
- github.com