CVE-2020-8091 — Cross-site Scripting in Typo3

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
20.5%
top 4.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Typo3Typo3 CMS
Timeline
PublishedJan 27
Latest updateMay 24

Description

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Packagisttypo3/cms7.0.0 — 7.2.0+1
▶NVDtypo3/typo36.2 — 6.2.39+1

🔴Vulnerability Details

3
GHSA
Typo3 Cross-Site Scripting in Flash component (ELTS)↗2022-05-24
▶
OSV
Typo3 Cross-Site Scripting in Flash component (ELTS)↗2022-05-24
▶
CVEList
CVE-2020-8091: svg↗2020-01-27
▶
CVE-2020-8091 — Cross-site Scripting in Typo3 | cvebase