Cross-Site Scripting in Page Preview

🗓️ 22 Jul 2021 19:34:43Reported by GitHub Advisory DatabaseType

Page Preview module vulnerable to persistent cross-site scripting due to improperly encoded Page TSconfig settings. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 address the issue

Reporter	Title	Published	Views	Family All 16
CNNVD	TYPO3 跨站脚本漏洞	20 Jul 202100:00	–	cnnvd
CNVD	TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17985)	22 Jul 202100:00	–	cnvd
CVE	CVE-2021-32667	20 Jul 202114:40	–	cve
Cvelist	CVE-2021-32667 Cross-Site Scripting in Page Preview	20 Jul 202114:40	–	cvelist
EUVD	EUVD-2021-1452	7 Oct 202500:30	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview	20 Jul 202109:14	–	friendsofphp
Friends Of PHP	TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview	20 Jul 202109:14	–	friendsofphp
NCSC	Vulnerabilities fixed in Typo3	20 Jul 202100:00	–	ncsc
NVD	CVE-2021-32667	20 Jul 202115:15	–	nvd
OpenVAS	TYPO3 XSS Vulnerability (TYPO3-CORE-SA-2021-009)	21 Jul 202100:00	–	openvas

Vulners

Node

typo3 cms_poll_system_extensionRange9.0.0–9.5.28composer

typo3 cms_poll_system_extensionRange11.0.0–11.3.1composer

typo3 cms_poll_system_extensionRange10.0.0–10.4.18composer

typo3 cms-coreRange11.0.0–11.3.1composer

typo3 cms-coreRange10.0.0–10.4.18composer

typo3 cms-coreRange9.0.0–9.5.28composer

Source	Link
github	www.github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-8mq9-fqv8-59wf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-32667
typo3	www.typo3.org/security/advisory/typo3-core-sa-2021-009
github	www.github.com/TYPO3/typo3/security/advisories/GHSA-8mq9-fqv8-59wf
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-32667.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-32667.yaml
github	www.github.com/advisories/GHSA-8mq9-fqv8-59wf

05 Feb 2024 11:16Current

2.6Low risk

Vulners AI Score2.6

CVSS 23.5

CVSS 3.15.4 - 6.4

EPSS0.00415

CWE-79