CVE-2021-21338: Open Redirection in Login Handling
Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability.
Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.
References TYPO3-CORE-SA-2021-001
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
— MITRE
TYPO3-CORE-SA-2021-001: Open Redirection in Login Handling
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this TYPO3 vulnerability?
The vulnerability ID is CVE-2021-21338.
What is the title of this TYPO3 vulnerability?
The title of this TYPO3 vulnerability is TYPO3-CORE-SA-2021-001: Open Redirection in Login Handling.
What is the severity of CVE-2021-21338?
The severity of CVE-2021-21338 has not been provided in the information provided.
Which versions of TYPO3 are affected by this vulnerability?
TYPO3 versions 10.0.0 to 10.4.14, 11.0.0 to 11.1.1, and 9.0.0 to 9.5.25 are affected by this vulnerability.
How can I fix the Open Redirection in Login Handling vulnerability in TYPO3?
To fix the Open Redirection in Login Handling vulnerability in TYPO3, update your TYPO3 installation to a version that is not affected by this vulnerability.