CVE-2021-21359 — Asymmetric Resource Consumption (Amplification) in Typo3

CWE-405 — Asymmetric Resource Consumption (Amplification)CWE-674 — Uncontrolled RecursionCWE-770 — Allocation of Resources Without Limits or Throttling7 documents4 sources
Severity
7.5HIGHNVD
CNA5.9
EPSS
0.3%
top 46.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Typo3Typo3 CMSTypo3 Cms-core+1 more
Timeline
PublishedMar 23
Latest updateDec 14

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14,…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Packagisttypo3/cms10.0.0 — 10.4.33+5
▶NVDtypo3/typo39.0.0 — 9.5.25+2
▶Packagisttypo3/cms-core9.0.0 — 9.5.38+6
▶CVEListV5typo3/typo34 versions+3
▶CVEListV5typo3/typo3.cms>= 10.0.0, <= 10.4.13, >= 11.0.0, <= 11.1.0, >= 9.0.0, <= 9.5.24+2

🔴Vulnerability Details

6
CVEList
TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service↗2022-12-14
▶
GHSA
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling↗2022-12-13
▶
GHSA
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling↗2022-09-16
▶
CVEList
Denial of Service in Page Error Handling↗2021-03-23
▶
GHSA
Denial of Service in Page Error Handling↗2021-03-23
▶
CVE-2021-21359 — Typo3 vulnerability | cvebase