CVE-2013-7341 Moodle cross-site scripting (XSS) vulnerabilities
Remote attackers can inject arbitrary web script or HTML via crafted parameters in the Flowplayer Flash library, affecting Moodle installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-7341?
CVE-2013-7341 is a medium-severity cross-site scripting vulnerability in Moodle Moodle, published on 22 Mar 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Weakness: CWE-79
Which versions are affected by CVE-2013-7341?
10 open source packages ship an affected version, including moodle/moodle and typo3/cms. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
moodle/moodle Packagist | All versions | 2.4.9 |
moodle/moodle Packagist | All versions | 2.4.9 |
moodle/moodle Packagist | From 2.5.0 | 2.5.5 |
moodle/moodle Packagist | From 2.5.0 | 2.5.5 |
moodle/moodle Packagist | From 2.6.0 | 2.6.2 |
moodle/moodle Packagist | From 2.6.0 | 2.6.2 |
4 more packages
typo3/cms Packagist | From 6.2.0 | 6.2.14 |
typo3/cms Packagist | From 6.2.0 | 6.2.14 |
typo3/cms Packagist | From 7.0.0 | 7.3.1 |
typo3/cms Packagist | From 7.0.0 | 7.3.1 |
Products include Flowplayer Flowplayer Flash, Moodle Moodle.
How do I fix CVE-2013-7341?
Upgrade moodle/moodle to a fixed version for your release line: 2.4.9, 2.5.5 or 2.6.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-7341 being exploited?
There is no known exploitation of CVE-2013-7341 in the wild and no public exploit code.
Other vulnerabilities in Moodle Moodle
Sources
Also known as GHSA-j6c3-3c4w-qv8p, UBUNTU-CVE-2013-7341.