CVE-2013-7341 in Flowplayer Flash
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2013-7341 represents a critical cross-site scripting weakness affecting Flowplayer Flash player versions prior to 3.2.17 when integrated into Moodle learning management systems. This issue manifests across multiple Moodle versions including 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, creating a widespread attack surface that compromises user sessions and data integrity. The vulnerability stems from inadequate input validation and sanitization mechanisms within the Flash player component, specifically when processing playerId parameters and external domain references. These weaknesses create pathways for malicious actors to inject arbitrary web scripts or HTML content that executes within the context of authenticated users' browsers.
The technical flaw resides in the improper handling of user-supplied input within the Flowplayer Flash implementation, which operates under CWE-79 - Improper Neutralization of Input During Web Page Generation. This vulnerability allows attackers to manipulate the playerId parameter or reference external domains to inject malicious payloads that persist in the application's execution context. The attack vector leverages the Flash player's ability to process external media sources and player identifiers without sufficient sanitization, enabling attackers to execute scripts in the victim's browser session. This issue is categorized under ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as it enables the delivery of malicious content through crafted player configurations.
The operational impact of this vulnerability extends beyond simple script injection, as it can lead to complete session hijacking, data theft, and privilege escalation within the Moodle environment. When users interact with maliciously crafted player configurations, their browsers execute the injected scripts, potentially allowing attackers to access course materials, user credentials, or modify learning content. The vulnerability affects the core functionality of Moodle's media handling capabilities, making it particularly dangerous as it can be exploited through legitimate course content delivery mechanisms. Attackers can leverage this weakness to create persistent backdoors or redirect users to malicious sites, effectively compromising the entire learning management system's security posture.
Mitigation strategies for CVE-2013-7341 require immediate patching of Flowplayer Flash components to version 3.2.17 or later, alongside comprehensive input validation and sanitization measures within Moodle installations. Organizations should implement strict content security policies that restrict external domain references and validate all playerId parameters before processing. Additionally, network-level controls such as web application firewalls should be configured to detect and block suspicious script injection patterns. The remediation process must include thorough testing of patched components to ensure compatibility with existing Moodle configurations while maintaining security controls. Security monitoring should be enhanced to detect anomalous player configuration requests that may indicate exploitation attempts. Regular security audits of third-party components and automated vulnerability scanning should be implemented to prevent similar issues from emerging in the future, as this vulnerability demonstrates the critical importance of maintaining up-to-date multimedia player components within educational platforms.