CVE-2011-3642 Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web scr...
CriticalCVSS 9.6
EPSS 8.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flowplayer flash | >= 3.2.7, <= 3.2.16 | No fix listed |
References
- appsec.ws broken-link
- secunia.com third-party-advisory
- secunia.com third-party-advisory
- secunia.com third-party-advisory
- typo3.org broken-link
- web.appsec.ws broken-link
- bugs.launchpad.net third-party-advisory
- code.google.com exploit third-party-advisory
- mahara.org third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry