TYPO3 allows remote attackers to embed Flash videos from external domain

MOYENNE 6.1CVE-2015-8760 · GHSA-3f58-74qw-ph75 · Published 08/01/2016 · updated 17/06/2026

En bref

CVE-2015-8760 est une vulnérabilité MOYENNE (CVSS 6.1) touchant typo3/cms, typo3 (typo3).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.4%, plus élevée que 73.1% des vulnérabilités.
Correctif : mettre à jour vers 6.2.16 ou plus récent.

Package	Affected versions	Patched versions
typo3/cms Packagist	`≥ 6.2.0, < 6.2.16`	`6.2.16`
typo3 typo3	`= 6.2= 6.2.0= 6.2.1= 6.2.10= 6.2.11= 6.2.12= 6.2.13= 6.2.14= 6.2.15= 6.2.2= 6.2.3= 6.2.4= 6.2.5= 6.2.6= 6.2.7= 6.2.8= 6.2.9`	No fix yet

Description

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

NVD description

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

References

nvd.nist.gov/vuln/detail/CVE-2015-8760 · ADVISORY
TYPO3/typo3 commit 29ae05c · WEB
TYPO3/typo3 · PACKAGE
typo3.org/security/advisory/typo3-core-sa-2015-014 · WEB
web.archive.org/web/20160621232021/http://www.securityfocus.com/bid/79210 · WEB
web.archive.org/web/20161012163613/http://www.securitytracker.com/id/1034485 · WEB
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014 · Vendor Advisory
securityfocus.com/bid/79210
securitytracker.com/id/1034485

Autres vulnérabilités de typo3/cms

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

typo3/cms

Packagist

≥ 6.2.0, < 6.2.16

6.2.16

typo3

= 6.2= 6.2.0= 6.2.1= 6.2.10= 6.2.11= 6.2.12= 6.2.13= 6.2.14= 6.2.15= 6.2.2= 6.2.3= 6.2.4= 6.2.5= 6.2.6= 6.2.7= 6.2.8= 6.2.9

No fix yet

Description

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

NVD description

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

Autres vulnérabilités de typo3/cms

Tout voir →