{"id":"CVE-2020-8091","details":"svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.","aliases":["BIT-typo3-2020-8091","GHSA-qvhv-pwww-53jj"],"modified":"2026-08-27T03:48:39.006973055Z","published":"2020-01-27T22:15:11.343Z","database_specific":{"unresolved_ranges":[{"vendor_product":"typo3:typo3","cpes":["cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"fixed":"6.2.39"},{"introduced":"6.2"},{"fixed":"6.2.39"},{"introduced":"6.2"},{"fixed":"6.2.39"}],"source":"CPE_RANGE"}]},"references":[{"type":"ADVISORY","url":"https://typo3.org/security/advisory/typo3-psa-2019-003/"},{"type":"EVIDENCE","url":"https://www.purplemet.com/blog/typo3-xss-vulnerability"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/TYPO3/typo3","events":[{"introduced":"583c888de32e077111951cced1a33571516cb5d3"},{"last_affected":"5fa3e3899f93a5fcc022ad2564c1f23855c81e5f"}],"database_specific":{"cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.1.0"}],"source":"CPE_RANGE"}}],"versions":["TYPO3_7-1-0","7.1.0","TYPO3_7-0-0","7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8091.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/benjaminkott/bootstrap_package","events":[{"introduced":"2bc505c5e22c84371390d6b9969da0e437094e93"},{"last_affected":"fe9f029bdc791fab9ac1c6fbf5f721522b961a10"}],"database_specific":{"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.1.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"}}],"versions":["7.1.0","v7.0.0","7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8091.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/typo3","events":[{"introduced":"583c888de32e077111951cced1a33571516cb5d3"},{"last_affected":"5fa3e3899f93a5fcc022ad2564c1f23855c81e5f"}],"database_specific":{"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.1.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"}}],"versions":["TYPO3_7-1-0","7.1.0","TYPO3_7-0-0","7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8091.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}