CVE-2013-7341: XSS
Cross-Site Scripting in 3rd party library Flowplayer
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 7.3.1 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 6.2.14 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.9
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7341?
CVE-2013-7341 is classified as a cross-site scripting (XSS) vulnerability that can lead to unauthorized script execution in affected applications.
How do I fix CVE-2013-7341?
To fix CVE-2013-7341, update Flowplayer Flash to version 3.2.17 or later or apply the patches provided for affected versions of Moodle.
Which versions are affected by CVE-2013-7341?
CVE-2013-7341 affects Flowplayer Flash versions prior to 3.2.17 and specific Moodle versions up to 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2.
Who can exploit CVE-2013-7341?
Remote attackers can exploit CVE-2013-7341 to inject arbitrary web scripts or HTML into vulnerable applications.
What impact does CVE-2013-7341 have on security?
CVE-2013-7341 can lead to session hijacking, defacement, or redirecting users to malicious websites, posing significant security risks.