{"id":"GHSA-j6c3-3c4w-qv8p","aliases":["CVE-2013-7341"],"title":"Moodle cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.","severity":"medium","score":null,"published":"2022-05-13T01:12:49.000Z","modified":"2024-12-03T06:08:31.322Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"moodle/moodle","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.4.9"}],"type":"ECOSYSTEM"}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8"],"fixed":["2.4.9"]},{"ecosystem":"Packagist","name":"moodle/moodle","ranges":[{"events":[{"introduced":"2.5.0"},{"fixed":"2.5.5"}],"type":"ECOSYSTEM"}],"versions":["v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4"],"fixed":["2.5.5"]},{"ecosystem":"Packagist","name":"moodle/moodle","ranges":[{"events":[{"introduced":"2.6.0"},{"fixed":"2.6.2"}],"type":"ECOSYSTEM"}],"versions":["v2.6.0","v2.6.1"],"fixed":["2.6.2"]},{"ecosystem":"Packagist","name":"typo3/cms","ranges":[{"events":[{"introduced":"6.2.0"},{"fixed":"6.2.14"}],"type":"ECOSYSTEM"}],"versions":["6.2.0","6.2.1","6.2.10","6.2.10-rc1","6.2.11","6.2.12","6.2.13","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9"],"fixed":["6.2.14"]},{"ecosystem":"Packagist","name":"typo3/cms","ranges":[{"events":[{"introduced":"7.0.0"},{"fixed":"7.3.1"}],"type":"ECOSYSTEM"}],"versions":["7.0.0","7.0.1","7.0.2","7.1.0","7.2.0","7.3.0"],"fixed":["7.3.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2013-7341","https://github.com/flowplayer/flash/issues/121","https://github.com/moodle/moodle/commit/98d135fea3006334093efa822205d4b2c3fd8ff9","https://github.com/moodle/moodle/commit/9f2967e301d123d11625f3b6948e1ee538086791","https://github.com/moodle/moodle/commit/c3cd5e1db9de4f1a634492d99990534e30518066","https://github.com/moodle/moodle/commit/d65634044ebaa738f55bdec521beb42844d6916a","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2013-7341.yaml","https://github.com/moodle/moodle","https://moodle.org/mod/forum/discuss.php?d=256420","https://typo3.org/security/advisory/typo3-core-sa-2015-007","http://flash.flowplayer.org/documentation/version-history.html","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344","http://openwall.com/lists/oss-security/2014/03/17/1"],"sources":[{"name":"OSV","id":"GHSA-j6c3-3c4w-qv8p","modified":"2024-12-03T06:08:31.322701Z","url":"https://osv.dev/vulnerability/GHSA-j6c3-3c4w-qv8p"}],"assessments":[]}