PT-2021-14453 · Typo3 · Typo3

Oliver Bartsch · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21370

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 7.6.51 TYPO3 versions prior to 8.7.40 TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The issue concerns content elements of type menu being vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

Recommendations Update to version 7.6.51 to resolve the issue. Update to version 8.7.40 to resolve the issue. Update to version 9.5.25 to resolve the issue. Update to version 10.4.14 to resolve the issue. Update to version 11.1.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-TYPO3-2021-21370

CVE-2021-21370

GHSA-X7HC-X7FM-F7QH

Affected Products

Typo3

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21370.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21370.yaml · Exploit
• https://typo3.org/security/advisory/typo3-core-sa-2021-008 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-21370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21370 · Security Note
• https://osv.dev/vulnerability/GHSA-x7hc-x7fm-f7qh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21370 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x7hc-x7fm-f7qh · Note
• https://t.me/cvenotify/11746 · Telegram Post
• https://packagist.org/packages/typo3/cms-backend · Note
• https://t.me/cibsecurity/25277 · Telegram Post