Log in Start free

Vulnerability · Published Apr 27, 2021 · Assigned by GitHub_M

CVE-2021-21365Cross-Site Scripting in Content Rendering

Medium 5.4

In plain English

A medium-severity cross-site scripting in bootstrap_package from benjaminkott. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.9%top 38.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistbk2k/bootstrap-package7.1.2GHSA-p48w-vf3c-rqjx
Packagistbk2k/bootstrap-package8.0.8GHSA-p48w-vf3c-rqjx
Packagistbk2k/bootstrap-package9.0.4GHSA-p48w-vf3c-rqjx
Packagistbk2k/bootstrap-package9.1.3GHSA-p48w-vf3c-rqjx
Packagistbk2k/bootstrap-package10.0.10GHSA-p48w-vf3c-rqjx
Packagistbk2k/bootstrap-package11.0.3GHSA-p48w-vf3c-rqjx

Affected products (as reported)

VendorProductVersions
benjaminkott bootstrap_package >= 7.1.0, < 7.1.2>= 8.0.0, < 8.0.8>= 9.0.0, < 9.0.4>= 9.1.0, < 9.1.3>= 10.0.0, < 10.0.10>= 11.0.0, < 11.0.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References