Typo3 · Typo3 · CVE-2021-32768
**Name of the Vulnerable Software and Affected Versions**
TYPO3 versions prior to 7.6.53 ELTS
TYPO3 versions prior to 8.7.42 ELTS
TYPO3 versions prior to 9.5.29
TYPO3 versions prior to 10.4.19
TYPO3 versions prior to 11.3.2
**Description**
The content rendering process in the website frontend is vulnerable to cross-site scripting due to failing to properly parse, sanitize, and encode malicious rich-text content. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag and attribute combinations by default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. However, if custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.
**Recommendations**
Update to TYPO3 version 7.6.53 ELTS to fix the problem described.
Update to TYPO3 version 8.7.42 ELTS to fix the problem described.
Update to TYPO3 version 9.5.29 to fix the problem described.
Update to TYPO3 version 10.4.19 to fix the problem described.
Update to TYPO3 version 11.3.2 to fix the problem described.
As a temporary workaround, consider restricting access to custom plugins that accept and reflect rich-text content submitted by users until a patch is available.
Restrict the use of the `lib.parseFunc` TypoScript path and the `f:format.html` Fluid view-helper instruction to minimize the risk of exploitation.