CVE-2021-21340 — Cross-site Scripting in Typo3

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.4%
top 40.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Typo3Typo3 CMSTypo3 Cms-backend+2 more
Timeline
PublishedMar 23

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 .

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶Packagisttypo3/cms-backend10.0.0 — 10.4.14+1
▶Packagisttypo3/cms10.0.0 — 10.4.14+1
▶NVDtypo3/typo310.0.0 — 10.4.14+1
▶Packagisttypo3/cms-core10.0.0 — 10.4.14+1
▶CVEListV5typo3/typo3.cms>= 10.0.0, <= 10.4.13, >= 11.0.0, <= 11.1.0+1

🔴Vulnerability Details

3
OSV
Cross-Site Scripting in Content Preview↗2021-03-23
▶
GHSA
Cross-Site Scripting in Content Preview↗2021-03-23
▶
CVEList
Cross-Site Scripting in Content Preview↗2021-03-23
▶
CVE-2021-21340 — Cross-site Scripting in Typo3 | cvebase