Description

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

Remediation

References

CVE-2020-8091

Related Vulnerabilities

WordPress Plugin Yandex Money button Cross-Site Scripting (2.3.3)

WordPress 2.2 Multiple Vulnerabilities (2.2)

PrestaShop Incorrect Authorization Vulnerability (CVE-2020-5293)

WordPress Plugin WooCommerce PDF Invoice Bulk Download Cross-Site Scripting (1.0.0)

b2evolution Other Vulnerability (CVE-2006-6197)

Severity

Medium

Classification

CVE-2020-8091 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities