PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

Description

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Source code
Browse source ↗
Published (advisory)
2022-05-13 01:12:57 UTC
Updated
2024-01-25 20:27:59 UTC
GitHub reviewed
2024-01-25 20:27:58 UTC
NVD published
2013-01-27

EPSS Score

Score Percentile
0.60% 68.61%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Credits

  • MarkLee131 (analyst)

Affected packages (4)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
composer moodle/moodle >= 2.1.0, < 2.1.10 2.1.10
composer moodle/moodle >= 2.2.0, < 2.2.7 2.2.7
composer moodle/moodle >= 2.3.0, < 2.3.4 2.3.4
composer moodle/moodle = 2.4.0 2.4.1

References

cvelogic Threat Intelligence