PT-2021-23097 · Typo3 · Typo3

Richie Lee · Published 2021-10-05 · Updated 2024-03-06 · CVE-2021-41113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.0

Description A cross-site request forgery issue has been discovered in the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface. This issue can be exploited without the need for the attacker to be authenticated and is not limited to the same site context. In a worst-case scenario, an attacker could create a new admin user account to compromise the system. The attack requires the victim to have an active session in the TYPO3 backend and to access a compromised system. Specific Same-Site cookie settings are required for the attack to be successful, including SameSite=strict for attacks from a different domain and SameSite=lax or none for attacks from a different top-level domain.

Recommendations Update to TYPO3 version 11.5.0 to address the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-309

CWE-352

Related Identifiers

BIT-TYPO3-2021-41113

CVE-2021-41113

GHSA-657M-V5VM-F6RW

Affected Products

Typo3

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2020-006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41113 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41113 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-41113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-657m-v5vm-f6rw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11069 · Security Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw · Note
• https://typo3.org/security/advisory/typo3-core-sa-2021-014 · Note
• https://t.me/cibsecurity/30001 · Telegram Post