CVE-2013-7341

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-24 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.

Affected products

Flowplayer Flash: through 3.2.16; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+23)
Moodle: through 2.3.11; 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+54)

References

http://flash.flowplayer.org/documentation/version-history.html
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344
http://openwall.com/lists/oss-security/2014/03/17/1
https://github.com/flowplayer/flash/issues/121
https://moodle.org/mod/forum/discuss.php?d=256420
http://flash.flowplayer.org/documentation/version-history.html
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344
http://openwall.com/lists/oss-security/2014/03/17/1
https://github.com/flowplayer/flash/issues/121
https://moodle.org/mod/forum/discuss.php?d=256420

Get alerted when CVE-2013-7341 or the next vulnerability affects your stack