CVE-2021-21358 — Cross-site Scripting in Typo3

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.4%
top 40.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Typo3Typo3 CMSTypo3 Cms-core+2 more
Timeline
PublishedMar 23

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶Packagisttypo3/cms-form10.2.0 — 10.4.14+1
▶Packagisttypo3/cms10.0.0 — 10.4.14+1
▶NVDtypo3/typo310.2.0 — 10.4.14+1
▶Packagisttypo3/cms-core10.0.0 — 10.4.14+1
▶CVEListV5typo3/typo3.cms>= 10.2.0, <= 10.4.13, >= 11.0.0, <= 11.1.0+1

🔴Vulnerability Details

3
OSV
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form↗2021-03-23
▶
CVEList
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form↗2021-03-23
▶
GHSA
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form↗2021-03-23
▶
CVE-2021-21358 — Cross-site Scripting in Typo3 | cvebase