Vulnerability advisory

BIT-typo3-2021-21340

Published Mar 6, 2024Updated Mar 6, 2024OSV record ↗

Also known as CVE-2021-21340GHSA-fjh3-g8gq-9q92

Severity

Severity not reported.

Affected versions

typo3 Bitnami

Affected Fixed in

10.0.0 to before 10.4.14 10.4.14

11.0.0 to before 11.1.1 11.1.1

Affected	Fixed in
`10.0.0` to before 10.4.14	`10.4.14`
`11.0.0` to before 11.1.1	`11.1.1`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Severity for this package

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 .

References

Webgithub.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92 ↗
Webpackagist.org/packages/typo3/cms-backend ↗
Webtypo3.org/security/advisory/typo3-core-sa-2021-007 ↗