CVE-2012-6112: Medium severity tinymce spellchecker vulnerability
classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6112?
CVE-2012-6112 is considered a medium severity vulnerability due to its potential to allow remote attackers to exploit it.
How do I fix CVE-2012-6112?
To fix CVE-2012-6112, upgrade to Moodle version 2.4.1, 2.3.4, 2.2.7, or 2.1.10 or later.
What software versions are affected by CVE-2012-6112?
CVE-2012-6112 affects TinyMCE Spellchecker versions up to 2.0.6 and Moodle versions prior to 2.1.10, 2.2.7, 2.3.4, and 2.4.1.
How does CVE-2012-6112 exploit control characters?
CVE-2012-6112 exploits the improper handling of control characters which can lead to information disclosure or remote code execution.
Is there a workaround for CVE-2012-6112?
There is no official workaround for CVE-2012-6112, so upgrading to the fixed versions is the recommended action.