{"api_version":"1","generated_at":"2026-07-23T09:09:33+00:00","cve":"CVE-2011-3642","urls":{"html":"https://cve.report/CVE-2011-3642","api":"https://cve.report/api/cve/CVE-2011-3642.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-3642","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-3642"},"summary":{"title":"CVE-2011-3642","description":"Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-02-08 16:15:00","updated_at":"2020-02-12 16:54:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://bugs.launchpad.net/mahara/+bug/1103748","name":"https://bugs.launchpad.net/mahara/+bug/1103748","refsource":"MISC","tags":["Third Party Advisory"],"title":"Bug #1103748 “included flowplayer 3.2.7 is vulnerable” : Bugs : Mahara","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.securityfocus.com/bid/48651","name":"https://www.securityfocus.com/bid/48651","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"Flowplayer 'linkUrl' Parameter Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://mahara.org/interaction/forum/topic.php?id=5237","name":"https://mahara.org/interaction/forum/topic.php?id=5237","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security Announcements - External vulnerability in Mahara flowplayer in <1.5.8 and <1.6.3 - Mahara ePortfolio System","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://appsec.ws/Presentations/FlashFlooding.pdf","name":"http://appsec.ws/Presentations/FlashFlooding.pdf","refsource":"MISC","tags":["Broken Link"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/52074","name":"http://secunia.com/advisories/52074","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security Advisory SA52074 - Mahara Flowplayer Cross-Site Scripting Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://code.google.com/p/flowplayer-core/issues/detail?id=441","name":"https://code.google.com/p/flowplayer-core/issues/detail?id=441","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Issue 441 - \n flowplayer-core -\n \n Arbitrary plugins with remote code execution (XSS) - \n Flowplayer core - Google Project Hosting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/58854","name":"http://secunia.com/advisories/58854","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security Advisory SA58854 - TYPO3 News System Extension Flowplayer and Flashmedia Cross-Site Scripting Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://web.appsec.ws/FlashExploitDatabase.php","name":"http://web.appsec.ws/FlashExploitDatabase.php","refsource":"MISC","tags":["Broken Link"],"title":"Flash Exploitation Database","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/54206","name":"http://secunia.com/advisories/54206","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security Advisory SA54206 - Flowplayer Flash &quot;plugin&quot; Domain Bypass Cross-Site Scripting Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009","name":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009","refsource":"MISC","tags":["Broken Link"],"title":"Cross-Site Scripting in news -  - TYPO3 - The Enterprise Open Source CMS","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-3642","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3642","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"3642","vulnerable":"1","versionEndIncluding":"3.2.16","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"flowplayer","cpe5":"flowplayer_flash","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"mahara","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"3642","vulnerable":"1","versionEndIncluding":"3.2.16","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"flowplayer","cpe5":"flowplayer_flash","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"typo3","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-3642","STATE":"PUBLIC"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"references":{"reference_data":[{"refsource":"MISC","name":"http://web.appsec.ws/FlashExploitDatabase.php","url":"http://web.appsec.ws/FlashExploitDatabase.php"},{"refsource":"MISC","name":"http://appsec.ws/Presentations/FlashFlooding.pdf","url":"http://appsec.ws/Presentations/FlashFlooding.pdf"},{"refsource":"MISC","name":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009","url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009"},{"refsource":"MISC","name":"https://code.google.com/p/flowplayer-core/issues/detail?id=441","url":"https://code.google.com/p/flowplayer-core/issues/detail?id=441"},{"refsource":"MISC","name":"https://mahara.org/interaction/forum/topic.php?id=5237","url":"https://mahara.org/interaction/forum/topic.php?id=5237"},{"refsource":"MISC","name":"http://secunia.com/advisories/52074","url":"http://secunia.com/advisories/52074"},{"refsource":"MISC","name":"http://secunia.com/advisories/54206","url":"http://secunia.com/advisories/54206"},{"refsource":"MISC","name":"http://secunia.com/advisories/58854","url":"http://secunia.com/advisories/58854"},{"refsource":"MISC","name":"https://www.securityfocus.com/bid/48651","url":"https://www.securityfocus.com/bid/48651"},{"refsource":"MISC","name":"https://bugs.launchpad.net/mahara/+bug/1103748","url":"https://bugs.launchpad.net/mahara/+bug/1103748"}]}},"nvd":{"publishedDate":"2020-02-08 16:15:00","lastModifiedDate":"2020-02-12 16:54:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL"},"exploitabilityScore":2.8,"impactScore":6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:flowplayer:flowplayer_flash:*:*:*:*:*:typo3:*:*","versionStartIncluding":"3.2.7","versionEndIncluding":"3.2.16","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:flowplayer:flowplayer_flash:*:*:*:*:*:mahara:*:*","versionStartIncluding":"3.2.7","versionEndIncluding":"3.2.16","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"3642","Ordinal":"50913","Title":"CVE-2011-3642","CVE":"CVE-2011-3642","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"3642","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.","Type":"Description","Title":null},{"CveYear":"2011","CveId":"3642","Ordinal":"2","NoteData":"2020-02-08","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"3642","Ordinal":"3","NoteData":"2020-02-08","Type":"Other","Title":"Modified"}]}}}