PT-2021-14434 · Typo3 · Typo3

Richie Lee · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21340

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The issue concerns database fields used as descriptionColumn that are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this issue.

Recommendations Update to version 10.4.14 to resolve the issue for versions prior to 10.4.14. Update to version 11.1.1 to resolve the issue for versions prior to 11.1.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-TYPO3-2021-21340

CVE-2021-21340

GHSA-FJH3-G8GQ-9Q92

Affected Products

Typo3

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21340.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21340.yaml · Exploit
• https://osv.dev/vulnerability/BIT-typo3-2021-21340 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21340 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21340 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjh3-g8gq-9q92 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92 · Note
• https://packagist.org/packages/typo3/cms-backend · Note
• https://t.me/cvenotify/11748 · Telegram Post
• https://t.me/cibsecurity/25268 · Telegram Post