Cross-Site Scripting in Page Preview
CVE-2021-32667

6.4MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3.cms
Vendor
CVE Published:
20 July 2021

What is CVE-2021-32667?

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When Page TSconfig settings are not properly encoded, corresponding page preview module (Web>View) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.

Affected Version(s)

TYPO3.CMS >= 9.0.0, < 9.5.29 < 9.0.0, 9.5.29

TYPO3.CMS >= 10.0.0, < 10.4.18 < 10.0.0, 10.4.18

TYPO3.CMS >= 11.0.0, < 11.3.1 < 11.0.0, 11.3.1

References

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GH...
x_refsource_CONFIRM
https://typo3.org/security/advisory/typo3-core-sa-2021-009
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.