Vulnerability advisory

CVE-2021-32669

Published Jul 20, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-typo3-2021-32669GHSA-rgcg-28xm-8mmw

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
41235ff8e38c6f3401df03ae8beddd62d662c525 through 860158afc7f8aceb8eb39495e37c80a6252ed1eb	No fix listed
c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce	No fix listed
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f	No fix listed
Also listed as affected (60) `v9.5.28` `v11.3.0` `v10.4.17` `v9.5.27` `v10.4.16` `v11.2.0` `v10.4.15` `v9.5.26` `v10.4.14` `v9.5.25` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v9.5.24` `v10.4.10` `v9.5.23` `v10.4.9` `v9.5.22` `v10.4.8` `v10.4.7` `v9.5.21` `v10.4.6` `v9.5.20` `v10.4.5` `v10.4.4` `v9.5.19` `v10.4.3` `v9.5.18` `v9.5.17` `v10.4.2` `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0` `v9.5.11` `v9.5.10` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v9.5.7` `v9.5.6` `v9.5.5` `v9.5.4` `v9.5.3` `v9.5.2` `v9.5.1` `v9.5.0` `v9.4.0` `v9.3.0` `v9.2.0` `v9.1.0` `v9.0.0`
GIT github.com/typo3/typo3 ↗
41235ff8e38c6f3401df03ae8beddd62d662c525 through 860158afc7f8aceb8eb39495e37c80a6252ed1eb	No fix listed
c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce	No fix listed
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f	No fix listed
Also listed as affected (60) `v9.5.28` `v11.3.0` `v10.4.17` `v9.5.27` `v10.4.16` `v11.2.0` `v10.4.15` `v9.5.26` `v10.4.14` `v9.5.25` `v11.1.0` `v10.4.13` `v11.0.0` `v10.4.12` `v10.4.11` `v9.5.24` `v10.4.10` `v9.5.23` `v10.4.9` `v9.5.22` `v10.4.8` `v10.4.7` `v9.5.21` `v10.4.6` `v9.5.20` `v10.4.5` `v10.4.4` `v9.5.19` `v10.4.3` `v9.5.18` `v9.5.17` `v10.4.2` `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0` `v9.5.11` `v9.5.10` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v9.5.7` `v9.5.6` `v9.5.5` `v9.5.4` `v9.5.3` `v9.5.2` `v9.5.1` `v9.5.0` `v9.4.0` `v9.3.0` `v9.2.0` `v9.1.0` `v9.0.0`

Description

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.

CVE-2021-32669

Affected versions

Repository

Description

References