CVE-2021-32667: TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a…

PriorityP425medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.60%

44.4th percentile

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
typo3	cms	>= 10.0.0 < 10.4.18	10.4.18
typo3	cms	>= 11.0.0 < 11.3.1	11.3.1
typo3	cms	>= 9.0.0 < 9.5.28	9.5.28
typo3	cms-core	>= 10.0.0 < 10.4.18	10.4.18
typo3	cms-core	>= 11.0.0 < 11.3.1	11.3.1
typo3	cms-core	>= 9.0.0 < 9.5.28	9.5.28
typo3	typo3	10.0.0 – 10.4.17	—
typo3	typo3	11.0.0 – 11.3.0	—
typo3	typo3	9.0.0 – 9.5.287	—
typo3	typo3.cms	—	—
typo3	typo3.cms	—	—
typo3	typo3.cms	—	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.