GitHub Advisoryadvisory · Packagist

GHSA-x7hc-x7fm-f7qh Cross-Site Scripting in Content Preview (CType menu)

MEDIUM Published 2021-03-23 Modified 2024-02-02 Official page ↗
Aliases
CVE-2021-21370
Ecosystem
Packagist
Packages
typo3/cms-backend, typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-03-23

Affected packages

• Packagist typo3/cms-backend: >= 7.0.0, < 7.6.51 → fixed in 7.6.51 • Packagist typo3/cms-backend: >= 8.0.0, < 8.7.40 → fixed in 8.7.40 • Packagist typo3/cms-backend: >= 9.0.0, < 9.5.25 → fixed in 9.5.25 • Packagist typo3/cms-backend: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms-backend: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms-core: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.25 → fixed in 9.5.25 • Packagist typo3/cms: >= 10.0.0, < 10.4.14 → fixed in 10.4.14 • Packagist typo3/cms: >= 11.0.0, < 11.1.1 → fixed in 11.1.1 • Packagist typo3/cms: >= 9.0.0, < 9.5.25 → fixed in 9.5.25

Description

Problem It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue. References • TYPO3-CORE-SA-2021-008

Related

Alias · CVE (1)

  • CVE-2021-21370 TYPO3 is an open source PHP based web content management system. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References