PT-2021-14442 · Typo3 · Typo3

Kay Strobach + 2 · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21359

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The issue arises when requesting invalid or non-existing resources via HTTP, triggering the page error handler. This handler can retrieve content from another page to be shown as an error message, leading to a recursive application call that amplifies the initial attack's impact until the web server's limits are exceeded.

Recommendations Update to version 9.5.25 to resolve the issue. Update to version 10.4.14 to resolve the issue. Update to version 11.1.1 to resolve the issue.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

CWE-405

Related Identifiers

BIT-TYPO3-2021-21359

CVE-2021-21359

GHSA-4P9G-QGX9-397P

Affected Products

Typo3

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21359.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21359.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21359 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2021-005 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21359 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4p9g-qgx9-397p · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-21359 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397p · Note
• https://t.me/cvenotify/39834 · Telegram Post
• https://packagist.org/packages/typo3/cms-core · Note
• https://t.me/cibsecurity/25276 · Telegram Post