PT-2021-14447 · Typo3 · Bootstrap Package

Oliver Hader · Published 2021-04-27 · Updated 2024-03-06 · CVE-2021-21365

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bootstrap Package versions 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3

Description The Bootstrap Package for TYPO3 has a cross-site scripting issue when rendering content in the website frontend. A valid backend user account is required to exploit this issue. The affected templates include Resources/Private/Partials/ContentElements/Carousel/Item/CallToAction.html, Resources/Private/Partials/ContentElements/Carousel/Item/Header.html, Resources/Private/Partials/ContentElements/Carousel/Item/Text.html, Resources/Private/Partials/ContentElements/Carousel/Item/TextAndImage.html, and Resources/Private/Partials/ContentElements/Header/SubHeader.html.

Recommendations Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package to fix the issue. Users who have overwritten the affected templates with custom code must manually apply the security fix. As a temporary workaround, consider restricting access to the affected templates until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-TYPO3-2021-21365

CVE-2021-21365

GHSA-P48W-VF3C-RQJX

Affected Products

Bootstrap Package

References · 8

• 🔥 https://github.com/benjaminkott/bootstrap_package/security/advisories/GHSA-p48w-vf3c-rqjx · Exploit
• 🔥 https://typo3.org/security/advisory/typo3-ext-sa-2021-007 · Exploit
• https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b · Patch
• https://osv.dev/vulnerability/GHSA-p48w-vf3c-rqjx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-21365 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21365 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21365 · Vendor Advisory
• https://t.me/cvenotify/14208 · Telegram Post