GitHub Advisoryadvisory · Packagist

GHSA-3f58-74qw-ph75 TYPO3 allows remote attackers to embed Flash videos from external domain

MEDIUM Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2015-8760
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-20, CWE-601
Reviewed
2025-04-14

Affected packages

• Packagist typo3/cms: >= 6.2.0, < 6.2.16 → fixed in 6.2.16

Description

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

Related

Alias · CVE (1)

  • CVE-2015-8760 The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-601 URL Redirection to Untrusted Site weakness

References