Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZwdzUtZ3J4eC12Mzk2

CSRF token exposure in TYPO3 extension

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.

Permalink: https://github.com/advisories/GHSA-vpw5-grxx-v396
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZwdzUtZ3J4eC12Mzk2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 3 years ago
Updated: almost 2 years ago

CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

Identifiers: GHSA-vpw5-grxx-v396, CVE-2021-36793
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-36793
• https://typo3.org/security/advisory/typo3-ext-sa-2021-008
• https://github.com/advisories/GHSA-vpw5-grxx-v396

Blast Radius: 1.9

Affected Packages