Vulnerability CVE-2012-6112

Vulnerability Name:

CVE-2012-6112 (CCN-81424)

Assigned:

2012-12-06

Published:

2013-01-15

Updated:

2020-12-01

Summary:

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

CVSS v3 Severity:

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Unknown

References:

Source: MITRE
Type: CNA
CVE-2012-6112

Source: CONFIRM
Type: UNKNOWN
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37283

Source: CCN
Type: Moodle Web Site
Moodle

Source: MLIST
Type: UNKNOWN
[oss-security] 20130121 Moodle security notifications public

Source: CCN
Type: SA51842
Moodle Multiple Vulnerabilities

Source: CONFIRM
Type: UNKNOWN
http://www.tinymce.com/develop/changelog/?type=phpspell

Source: CONFIRM
Type: Vendor Advisory
http://www.tinymce.com/forum/viewtopic.php?id=30036

Source: XF
Type: UNKNOWN
moodle-tinymce-spellchecker-unspecified(81424)

Source: CONFIRM
Type: UNKNOWN
https://github.com/tinymce/tinymce_spellchecker_php/commit/22910187bfb9edae90c26e10100d8145b505b974

Source: CCN
Type: MSA-13-0001
Security issue in Google Spellchecker in TinyMCE

Source: CONFIRM
Type: UNKNOWN
https://moodle.org/mod/forum/discuss.php?d=220157

Vulnerable Configuration:

Configuration 1:

cpe:/a:tinymce:spellchecker_php:2.0:b2:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:b1:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:a2:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:rc1:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:a1:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:*:*:*:*:*:*:*

OR cpe:/a:tinymce:spellchecker_php:2.0:b3:*:*:*:*:*:*

Configuration 2:

cpe:/a:moodle:moodle:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.7:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.9:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.1.6:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:moodle:moodle:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.2.2:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:moodle:moodle:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.3.0:*:*:*:*:*:*:*

Configuration 5:

cpe:/a:moodle:moodle:2.4.0:*:*:*:*:*:*:*

Configuration CCN 1: