PT-2021-3865 · Typo3 · Typo3

Richie Lee · Published 2021-07-20 · Updated 2024-03-06 · CVE-2021-32668

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 9.0.0 through 9.5.28 TYPO3 versions 10.0.0 through 10.4.17 TYPO3 versions 11.0.0 through 11.3.0

Description The issue is related to the components QueryGenerator and QueryView in the TYPO3 content management system, which are vulnerable to both reflected and persistent cross-site scripting when error messages are not properly encoded. A valid backend user account with administrator privileges is needed to exploit this issue.

Recommendations For versions 9.0.0 through 9.5.28, update to version 9.5.29. For versions 10.0.0 through 10.4.17, update to version 10.4.18. For versions 11.0.0 through 11.3.0, update to version 11.3.1. As a temporary workaround, consider restricting access to the QueryGenerator and QueryView components until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04223

BIT-TYPO3-2021-32668

CVE-2021-32668

GHSA-6MH3-J5R5-2379

Affected Products

Typo3

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-32668.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-32668.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32668 · Security Note
• https://bdu.fstec.ru/vul/2021-04223 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2021-010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mh3-j5r5-2379 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-32668 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-6mh3-j5r5-2379 · Note
• https://t.me/cibsecurity/26287 · Telegram Post