Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3aGMteDdmbS1mN3Fo

Cross-Site Scripting in Content Preview (CType menu)

Meta

• CVSS: AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1)
• CWE-79
• Status: DRAFT

Problem

It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

Solution

Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Credits

Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.

References

• TYPO3-CORE-SA-2021-008

Permalink: https://github.com/advisories/GHSA-x7hc-x7fm-f7qh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3aGMteDdmbS1mN3Fo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 2 years ago
Updated: 8 months ago

Identifiers: GHSA-x7hc-x7fm-f7qh, CVE-2021-21370
References:

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x7hc-x7fm-f7qh
• https://packagist.org/packages/typo3/cms-backend
• https://nvd.nist.gov/vuln/detail/CVE-2021-21370
• https://typo3.org/security/advisory/typo3-core-sa-2021-008
• https://github.com/advisories/GHSA-x7hc-x7fm-f7qh

Affected Packages