PT-2021-14433 · Typo3 · Typo3

Oliver Hader · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21339

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 6.2.57 TYPO3 versions prior to 7.6.51 TYPO3 versions prior to 8.7.40 TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The issue concerns user session identifiers being stored in cleartext without additional cryptographic hashing algorithms. This cannot be exploited directly and occurs in combination with a chained attack, such as SQL injection in another system component.

Recommendations Update to version 6.2.57 Update to version 7.6.51 Update to version 8.7.40 Update to version 9.5.25 Update to version 10.4.14 Update to version 11.1.1

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BIT-TYPO3-2021-21339

CVE-2021-21339

GHSA-QX3W-4864-94CH

Affected Products

Typo3

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21339.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21339.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21339 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2021-006 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21339 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qx3w-4864-94ch · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-21339 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-qx3w-4864-94ch · Note
• https://packagist.org/packages/typo3/cms-core · Note
• https://t.me/cibsecurity/25280 · Telegram Post