GitHub Advisoryadvisory · Packagist

GHSA-4jhw-2p6j-5wmp Open Redirection in Login Handling

MEDIUM Published 2021-03-23 Modified 2021-03-29 Official page ↗
Aliases
CVE-2021-21338
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-03-23

Affected packages

• Packagist typo3/cms-core: >= 6.2.0, < 6.2.57 → fixed in 6.2.57 • Packagist typo3/cms-core: >= 7.0.0, < 7.6.51 → fixed in 7.6.51 • Packagist typo3/cms-core: >= 8.0.0, < 8.7.40 → fixed in 8.7.40 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms-core: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.25 → fixed in 9.5.25 • Packagist typo3/cms: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms: >= 9.0.0, < 9.5.25 → fixed in 9.5.25

Description

Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. References • TYPO3-CORE-SA-2021-001

Related

Alias · CVE (1)

  • CVE-2021-21338 TYPO3 is an open source PHP based web content management system. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References