CVE-2012-6112 - CVE House
Back to Database
Status published Medium CVE-2012-6112

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before...

Vulnerability Description

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-6112

Credits & Attribution

No credits recorded in the NVD database.

References

More from tinymce

View All →
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium 6.1
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium 6.1
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Medium 4.3
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Medium 4.3
CVE-2023-48219
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
Medium 6.1

Affected Vendor

Affected Software

spellchecker php, moodle
Vulnerable Versions:
2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.6, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0

Timeline

Official Publish: January 27th, 2013
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.