CVE-2011-3642

Katalog CVE

CVSS 9.6 · Critical EPSS 8,8%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada flowplayer flash. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.

Rincian

Terbit di NVD

8 Februari 2020

Terakhir diubah

16 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

8,8% peluang dieksploitasi; lebih tinggi dari 95,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://secunia.com/advisories/52074 advisory pihak ketiga
• http://secunia.com/advisories/54206 advisory pihak ketiga
• http://secunia.com/advisories/58854 advisory pihak ketiga
• https://bugs.launchpad.net/mahara/+bug/1103748 advisory pihak ketiga
• https://code.google.com/p/flowplayer-core/issues/detail?id=441 exploit · advisory pihak ketiga
• https://mahara.org/interaction/forum/topic.php?id=5237 advisory pihak ketiga
• https://www.securityfocus.com/bid/48651 advisory pihak ketiga · vdb entry
• http://appsec.ws/Presentations/FlashFlooding.pdf broken link
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009 broken link
• http://web.appsec.ws/FlashExploitDatabase.php broken link