CVE-2021-32668
published 2021-07-20CVE-2021-32668: TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a…
PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.60%
44.1th percentile
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 10.0.0 < 10.4.18 | 10.4.18 |
| typo3 | cms | >= 11.0.0 < 11.3.1 | 11.3.1 |
| typo3 | cms | >= 9.0.0 < 9.5.28 | 9.5.28 |
| typo3 | cms-core | >= 10.0.0 < 10.4.18 | 10.4.18 |
| typo3 | cms-core | >= 11.0.0 < 11.3.1 | 11.3.1 |
| typo3 | cms-core | >= 8.0.0 < 8.7.41 | 8.7.41 |
| typo3 | cms-core | >= 9.0.0 < 9.5.28 | 9.5.28 |
| typo3 | typo3 | 10.0.0 – 10.4.17 | — |
| typo3 | typo3 | 11.0.0 – 11.3.0 | — |
| typo3 | typo3 | 8.0.0 – 8.7.40 | — |
| typo3 | typo3 | 9.0.0 – 9.5.28 | — |
| typo3 | typo3.cms | — | — |
| typo3 | typo3.cms | — | — |
| typo3 | typo3.cms | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-Site Scripting in Query Generator & Query View
osv·2021-07-22
CVE-2021-32668 [MEDIUM] Cross-Site Scripting in Query Generator & Query View
Cross-Site Scripting in Query Generator & Query View
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5)
### Problem
Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.
### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.
### References
* [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
GHSA
Cross-Site Scripting in Query Generator & Query View
ghsa·2021-07-22
CVE-2021-32668 [MEDIUM] CWE-79 Cross-Site Scripting in Query Generator & Query View
Cross-Site Scripting in Query Generator & Query View
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5)
### Problem
Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.
### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.
### References
* [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-07-20
Published