CVE-2011-3642

CriticalCVSS 9.6/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://appsec.ws/Presentations/FlashFlooding.pdfBroken Link
http://secunia.com/advisories/52074Third Party Advisory
http://secunia.com/advisories/54206Third Party Advisory
http://secunia.com/advisories/58854Third Party Advisory
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009Broken Link
http://web.appsec.ws/FlashExploitDatabase.phpBroken Link
https://bugs.launchpad.net/mahara/+bug/1103748Third Party Advisory
https://code.google.com/p/flowplayer-core/issues/detail?id=441Exploit, Third Party Advisory
https://mahara.org/interaction/forum/topic.php?id=5237Third Party Advisory
https://www.securityfocus.com/bid/48651Third Party Advisory, VDB Entry
http://appsec.ws/Presentations/FlashFlooding.pdfBroken Link
http://secunia.com/advisories/52074Third Party Advisory
http://secunia.com/advisories/54206Third Party Advisory
http://secunia.com/advisories/58854Third Party Advisory
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009Broken Link
http://web.appsec.ws/FlashExploitDatabase.phpBroken Link
https://bugs.launchpad.net/mahara/+bug/1103748Third Party Advisory
https://code.google.com/p/flowplayer-core/issues/detail?id=441Exploit, Third Party Advisory
https://mahara.org/interaction/forum/topic.php?id=5237Third Party Advisory
https://www.securityfocus.com/bid/48651Third Party Advisory, VDB Entry

Timeline

Published: Feb 8, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-36457.5Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.j CVE-2011-36465.0phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame para CVE-2011-36479.3The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls CVE-2011-36484.3Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7 CVE-2011-36492.6Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end,CVE-2011-36509.3Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files t CVE-2011-365110.0Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a deni CVE-2011-365210.0The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly allocate memory, which allows remote attackers CVE-2011-36535.0Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU memory behavior of a certain driver CVE-2011-365410.0The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SV CVE-2011-36559.3Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapp CVE-2011-36566.1Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7 allows remote attackers to inject arbitrary web