CVE-2012-6112: classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before…

Unscored severity · published Jan 27, 2013

CVE-2012-6112

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before…

–

CVSS

2.3%

EPSS

On KEV

Description

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.3% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Moodle · Moodle

2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +16 more · source: NVD

Spellchecker Php · Tinymce

2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +5 more · source: NVD