SB2021031617 - Multiple vulnerabilities in TYPO3
Published: March 16, 2021 Updated: May 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2021-21370)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Content Preview Renderer component. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Uncontrolled Recursion (CVE-ID: CVE-2021-21359)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. A remote attacker can cause a denial of service condition on the target system.
3) Cleartext storage of sensitive information (CVE-ID: CVE-2021-21339)
CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the user session identifiers being stored in clear text. A remote attacker can gain access to sensitive information on the target system.
4) Cross-site scripting (CVE-ID: CVE-2021-21358)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Form Designer backend module. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Cross-site scripting (CVE-ID: CVE-2021-21340)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Content Preview Renderer component. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Open redirect (CVE-ID: CVE-2021-21338)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to redirect users to arbitrary content.
The vulnerability exists due to url redirection to untrusted site in login handling when processing login requests with a user-controlled redirect target. A remote attacker can supply a crafted redirect target to redirect users to arbitrary content.
User interaction is required for successful exploitation, which can facilitate phishing attacks.
7) Arbitrary file upload (CVE-ID: CVE-2021-21355)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to upload arbitrary files and disclose sensitive information.
The vulnerability exists due to unrestricted file upload in UploadedFileReferenceConverter and the form framework when handling file uploads with file extensions that do not match configured allowed mime-types. A remote attacker can upload arbitrary data with arbitrary file extensions to upload arbitrary files and disclose sensitive information.
Uploaded files are stored in a predictable default location and often keep the submitted filename, which can enable direct access to uploaded files and guessing filenames used by other individuals.
8) Arbitrary file upload (CVE-ID: CVE-2021-21357)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to upload arbitrary files and write them to arbitrary writable directories.
The vulnerability exists due to improper input validation in the Form Designer backend module of the Form Framework when processing submitted form configuration data. A remote user can bypass restrictions of predefined options to upload arbitrary files and write them to arbitrary writable directories.
Exploitation requires a valid backend user account with access to the form module.
9) Uncontrolled Recursion (CVE-ID: CVE-2022-36104)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the page error handler when handling requests for invalid or non-existing resources via HTTP. A remote attacker can send crafted requests for invalid or non-existing resources to cause a denial of service.
The issue can cause the application to call itself recursively, amplifying the impact until web server limits are exceeded.
Remediation
Install update from vendor's website.
References
- https://typo3.org/security/advisory/typo3-core-sa-2021-008/
- https://typo3.org/security/advisory/typo3-core-sa-2021-005/
- https://typo3.org/security/advisory/typo3-core-sa-2021-006/
- https://typo3.org/security/advisory/typo3-core-sa-2021-004/
- https://typo3.org/security/advisory/typo3-core-sa-2021-007/
- https://github.com/TYPO3/typo3/security/advisories/GHSA-4jhw-2p6j-5wmp
- https://typo3.org/security/advisory/typo3-core-sa-2021-001
- https://github.com/TYPO3/typo3/security/advisories/GHSA-2r6j-862c-m2v2
- https://typo3.org/security/advisory/typo3-core-sa-2021-002
- https://github.com/TYPO3/typo3/security/advisories/GHSA-3vg7-jw9m-pc3f
- https://typo3.org/security/advisory/typo3-core-sa-2021-003
- https://github.com/TYPO3/typo3/security/advisories/GHSA-fffr-7x4x-f98q
- https://typo3.org/security/advisory/typo3-core-sa-2022-006