Vulnerability advisory

GHSA-qx3w-4864-94ch

Cleartext storage of session identifier

Published Mar 23, 2021Updated Jul 8, 2026OSV record ↗

Also known as BIT-typo3-2021-21339CVE-2021-21339

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`6.2.0` to before 6.2.57	`6.2.57`Advisories →
`7.0.0` to before 7.6.51	`7.6.51`Advisories →
`8.0.0` to before 8.7.40	`8.7.40`Advisories →
Also listed as affected (26) `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.25` `v8.7.26` `v8.7.27` `v8.7.28` `v8.7.29` `v8.7.30` `v8.7.31` `v8.7.32` `v8.7.7` `v8.7.8` `v8.7.9`
`10.0.0` to before 10.4.14	`10.4.14`Advisories →
Also listed as affected (20) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.1.1	`11.1.1`Advisories →
Also listed as affected (2) `v11.0.0` `v11.1.0`
`9.0.0` to before 9.5.25	`9.5.25`Advisories →
Also listed as affected (34) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.20` `v9.5.21` `v9.5.22` `v9.5.23` `v9.5.24` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`10.0.0` to before 10.4.14	`10.4.14`Advisories →
Also listed as affected (20) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.1.1	`11.1.1`Advisories →
Also listed as affected (2) `v11.0.0` `v11.1.0`
`9.0.0` to before 9.5.25	`9.5.25`Advisories →
Also listed as affected (34) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.20` `v9.5.21` `v9.5.22` `v9.5.23` `v9.5.24` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`

Description

Problem

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

Solution

Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Credits

Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue.

References

TYPO3-CORE-SA-2021-006