5.4

CVE-2021-21370

Cross-Site Scripting in Content Preview (CType menu)

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Typo3 ≫ Typo3 Version >= 7.0.0 < 7.6.51
Typo3 ≫ Typo3 Version >= 8.0.0 < 8.7.40
Typo3 ≫ Typo3 Version >= 9.0.0 < 9.5.25
Typo3 ≫ Typo3 Version >= 10.0.0 < 10.4.14
Typo3 ≫ Typo3 Version >= 11.0.0 < 11.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.562
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
security-advisories@github.com 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://packagist.org/packages/typo3/cms-backend
Third Party Advisory
Release Notes