Cross-Site Scripting in Content Preview

🗓️ 23 Mar 2021 01:53:47Reported by GitHub Advisory DatabaseType

Cross-Site Scripting in Content Preview. Update TYPO3 versions to fix vulnerability. Requires valid backend user account to exploit. Thanks to Richie Lee and TYPO3 framework merger Andreas Fernandez.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2021-21340	23 Mar 202102:15	–	attackerkb
Circl	CVE-2021-21340	23 Mar 202106:37	–	circl
CNNVD	TYPO3 跨站脚本漏洞	16 Mar 202100:00	–	cnnvd
CNVD	TYPO3 cross-site scripting vulnerability (CNVD-2021-22139)	23 Mar 202100:00	–	cnvd
CVE	CVE-2021-21340	23 Mar 202101:50	–	cve
Cvelist	CVE-2021-21340 Cross-Site Scripting in Content Preview	23 Mar 202101:50	–	cvelist
EUVD	EUVD-2021-0653	7 Oct 202500:30	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2021-007: Cross-Site Scripting in Content Preview	16 Mar 202109:01	–	friendsofphp
Friends Of PHP	TYPO3-CORE-SA-2021-007: Cross-Site Scripting in Content Preview	16 Mar 202109:01	–	friendsofphp
NCSC	Vulnerabilities fixed in TYPO3	16 Mar 202100:00	–	ncsc

Vulners

Node

typo3 cms_poll_system_extensionRange11.0.0–11.1.1composer

typo3 cms_poll_system_extensionRange10.0.0–10.4.14composer

typo3 cms-coreRange11.0.0–11.1.1composer

typo3 cms-coreRange10.0.0–10.4.14composer

typo3 cms-backendRange11.0.0–11.1.0composer

typo3 cms-backendRange10.0.0–10.4.13composer

Source	Link
github	www.github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92
packagist	www.packagist.org/packages/typo3/cms-backend
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21340
typo3	www.typo3.org/security/advisory/typo3-core-sa-2021-007
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21340.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21340.yaml
github	www.github.com/advisories/GHSA-fjh3-g8gq-9q92

02 Feb 2024 16:44Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00379

CWE-79