--- title: "TYPO3-CORE-SA-2012-003: Cross-Site Scripting Vulnerability in TYPO3 Core" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2012-003" description: It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2012-003: Cross-Site Scripting Vulnerability in TYPO3 Core - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2012-003: Cross-Site Scripting Vulnerability in TYPO3 Core ======================================================================== 04 July 2012 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause) **Component Type:** TYPO3 Core **Affected Versions:** 4.5.0 up to 4.5.16, 4.6.0 up to 4.6.9, 4.7.0 up to 4.7.1 and development releases of the 6.0 branch. **Bulletin history:** July 4, 2012 - corrected Secunia Advisory ID Vulnerable subcomponent: Flash File Uploader -------------------------------------------- **Vulnerability Type:** Cross-Site Scripting **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **CVE:** CVE-2012-3414 **Problem Description:** TYPO3 bundles and uses an external JavaScript & Flash Upload Library called swfupload. TYPO3 can be configured to use this Flash uploader. Input passed via the "movieName" parameter to swfupload.swf is not properly sanitised before being used in a call to "ExternalInterface.call()". This can be exploited to execute arbitrary script code in a user's browser session in context of an affected site. The existance of the swfupload library is sufficient to be vulnerable to the reported problem. **Note:** The vulnerability in the swfupload library is addressed by Secunia Advisory SA49651. **Solution:** Update to the TYPO3 versions 4.5.17, 4.6.10 or 4.7.2 that fix the problem described! **Credits:** Credits go to Nathan Partlan and Neal Poole who discovered the original movieName XSS vulnerability in the swfupload library and Lukas Reschke who reported the problem to the TYPO3 Security Team. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://typo3.org/extension-manuals/doc_guide_security/current/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Subscribe to the typo3-announce mailing list") mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg) About the Author [Marcus Krause](https://news.typo3.com/article/author/marcus-krause) [More posts by this author](https://news.typo3.com/article/author/marcus-krause)