Description
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-qvhv-pwww-53jj |
| Packagist | typo3/cms | >= 6.2.0, < 6.2.39 | 6.2.39 | GHSA-qvhv-pwww-53jj |