PT-2021-14432 · Typo3 · Typo3

Alexander Kellner · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21338

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 6.2.57 TYPO3 versions prior to 7.6.51 TYPO3 versions prior to 8.7.40 TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The Login Handling in TYPO3 is susceptible to open redirection, allowing attackers to redirect to arbitrary content and conduct phishing attacks. No authentication is required to exploit this issue.

Recommendations Update to version 6.2.57 Update to version 7.6.51 Update to version 8.7.40 Update to version 9.5.25 Update to version 10.4.14 Update to version 11.1.1

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-TYPO3-2021-21338

CVE-2021-21338

GHSA-4JHW-2P6J-5WMP

Affected Products

Typo3

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21338.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21338.yaml · Exploit
• https://typo3.org/security/advisory/typo3-core-sa-2021-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21338 · Security Note
• https://osv.dev/vulnerability/BIT-typo3-2021-21338 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jhw-2p6j-5wmp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21338 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4jhw-2p6j-5wmp · Note
• https://packagist.org/packages/typo3/cms-core · Note
• https://t.me/cvenotify/11747 · Telegram Post
• https://t.me/cibsecurity/25267 · Telegram Post