Log in Start free

Vulnerability · Published Aug 10, 2021 · Assigned by GitHub_M

CVE-2021-32768Cross-Site Scripting via Rich-Text Content

Medium 6.1

In plain English

A medium-severity cross-site scripting in TYPO3.CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.7%top 45.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms7.6.53GHSA-c5c9-8c6m-727v
Packagisttypo3/cms10.4.19GHSA-c5c9-8c6m-727v
Packagisttypo3/cms11.3.2GHSA-c5c9-8c6m-727v
Packagisttypo3/cms9.5.29GHSA-c5c9-8c6m-727v
Packagisttypo3/cms8.7.42GHSA-c5c9-8c6m-727v
Packagisttypo3/cms-core7.6.53GHSA-c5c9-8c6m-727v
Packagisttypo3/cms-core8.7.42GHSA-c5c9-8c6m-727v
Packagisttypo3/cms-core10.4.19GHSA-c5c9-8c6m-727v
Packagisttypo3/cms-core11.3.2GHSA-c5c9-8c6m-727v
Packagisttypo3/cms-core9.5.29GHSA-c5c9-8c6m-727v

Affected products (as reported)

VendorProductVersions
TYPO3 TYPO3.CMS >= 7.0.0, < 7.6.53>= 8.0.0, < 8.7.42>= 9.0.0, < 9.5.29>= 10.0.0, < 10.4.19>= 11.0.0, < 11.3.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References