Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZqaDMtZzhncS05cTky

Cross-Site Scripting in Content Preview

Meta

• CVSS: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.0)
• CWE-79
• Status: DRAFT

Problem

It has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

Solution

Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.

Credits

Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

References

• TYPO3-CORE-SA-2021-007

Permalink: https://github.com/advisories/GHSA-fjh3-g8gq-9q92
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZqaDMtZzhncS05cTky
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 2 years ago
Updated: 8 months ago

Identifiers: GHSA-fjh3-g8gq-9q92, CVE-2021-21340
References:

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92
• https://packagist.org/packages/typo3/cms-backend
• https://nvd.nist.gov/vuln/detail/CVE-2021-21340
• https://typo3.org/security/advisory/typo3-core-sa-2021-007
• https://github.com/advisories/GHSA-fjh3-g8gq-9q92

Affected Packages