An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3aGMteDdmbS1mN3Fo
Cross-Site Scripting in Content Preview (CType menu)
- Status: DRAFT
It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.
Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.
Source: GitHub Advisory Database
Published: over 2 years ago
Updated: 8 months ago
Identifiers: GHSA-x7hc-x7fm-f7qh, CVE-2021-21370
Fixed in: 11.1.1, 10.4.14, 9.5.25, 8.7.40, 7.6.51