Test ID:	1.3.6.1.4.1.25623.1.0.804200
Category:	Web application abuses
Title:	TYPO3 SWFUpload movieName Cross Site Scripting Vulnerability
Summary:	TYPO3 is prone to a cross-site scripting (XSS) vulnerability.
Description:	Summary: TYPO3 is prone to a cross-site scripting (XSS) vulnerability. Vulnerability Insight: An error exists in swfupload.swf, which fails to validate the 'movieName' parameter properly. Vulnerability Impact: Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials. Affected Software/OS: TYPO3 version 4.5.0 up to 4.5.16, 4.6.0 up to 4.6.9, 4.7.0 up to 4.7.1 Solution: Upgrade to TYPO3 version 4.5.17, 4.6.10, 4.7.2 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3414 BugTraq ID: 54245 http://www.securityfocus.com/bid/54245 http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html http://code.google.com/p/swfupload/issues/detail?id=376 http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/ http://www.openwall.com/lists/oss-security/2012/07/16/4 http://www.openwall.com/lists/oss-security/2012/07/17/12
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.