MEDIUM6.1

GHSA-3f58-74qw-ph75

TYPO3 allows remote attackers to embed Flash videos from external domain

Quick fix

GHSA-3f58-74qw-ph75 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^6.2.16

Details

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 6.2.0Fixed in: 6.2.16

Fixcomposer require typo3/cms:^6.2.16

References

https://nvd.nist.gov/vuln/detail/CVE-2015-8760[ADVISORY]
https://github.com/TYPO3/typo3/commit/29ae05c04cb48d4031d323f17d8f2b68b27af353[WEB]
https://github.com/TYPO3/typo3[PACKAGE]
https://typo3.org/security/advisory/typo3-core-sa-2015-014[WEB]
https://web.archive.org/web/20160621232021/http://www.securityfocus.com/bid/79210[WEB]
https://web.archive.org/web/20161012163613/http://www.securitytracker.com/id/1034485[WEB]