CVE-2012-6112

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2013-01-27

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Moodle (Moodle)
• Spellchecker Php (Tinymce)

References

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37283
• http://openwall.com/lists/oss-security/2013/01/21/1
• http://www.tinymce.com/develop/changelog/?type=phpspell
• http://www.tinymce.com/forum/viewtopic.php?id=30036
• https://github.com/tinymce/tinymce_spellchecker_php/commit/22910187bfb9edae90c26e10100d8145b505b974
• https://moodle.org/mod/forum/discuss.php?d=220157