Vulnerability advisory

CVE-2021-32667

Published Jul 20, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-typo3-2021-32667GHSA-8mq9-fqv8-59wf

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce	No fix listed
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f	No fix listed
Also listed as affected (26) `v11.3.0` `v10.4.17` `v10.4.16` `v11.2.0` `v10.4.15` `v10.4.14` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v10.4.10` `v10.4.9` `v10.4.8` `v10.4.7` `v10.4.6` `v10.4.5` `v10.4.4` `v10.4.3` `v10.4.2` `v10.4.1` `v10.4.0` `v10.3.0` `v10.2.0` `v10.1.0` `v10.0.0`
GIT github.com/typo3/typo3 ↗
c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce	No fix listed
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f	No fix listed
Also listed as affected (26) `v11.3.0` `v10.4.17` `v10.4.16` `v11.2.0` `v10.4.15` `v10.4.14` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v10.4.10` `v10.4.9` `v10.4.8` `v10.4.7` `v10.4.6` `v10.4.5` `v10.4.4` `v10.4.3` `v10.4.2` `v10.4.1` `v10.4.0` `v10.3.0` `v10.2.0` `v10.1.0` `v10.0.0`

Description

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When Page TSconfig settings are not properly encoded, corresponding page preview module (Web>View) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.

CVE-2021-32667

Affected versions

Repository

Description

References