CVE-2021-21339: Cleartext storage of session identifier
Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.
Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue.
References TYPO3-CORE-SA-2021-006
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
— MITRE
TYPO3-CORE-SA-2021-006: Cleartext storage of session identifier
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21339?
CVE-2021-21339 is a vulnerability in TYPO3 where user session identifiers were stored in cleartext without cryptographic hashing, allowing potential attackers to gain unauthorized access to user sessions.
What is the severity of CVE-2021-21339?
The severity of CVE-2021-21339 is high with a CVSS score of 7.5.
How does CVE-2021-21339 impact TYPO3?
CVE-2021-21339 affects TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1, where user session identifiers are stored in cleartext, potentially compromising user sessions.
What is the recommended fix for CVE-2021-21339?
To fix CVE-2021-21339, TYPO3 users should upgrade to versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, or 11.1.1 where this vulnerability has been patched.
Where can I find more information about CVE-2021-21339?
More information about CVE-2021-21339 can be found at the TYPO3 Security Advisory TYPO3-CORE-SA-2021-006, GitHub Advisory GHSA-qx3w-4864-94ch, and Packagist.