CVE-2021-21340: Cross-Site Scripting in Content Preview
Problem It has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.
Solution Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.
Credits Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.
References TYPO3-CORE-SA-2021-007
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 .
TYPO3-CORE-SA-2021-007: Cross-Site Scripting in Content Preview
Affected Software
Event History
Frequently Asked Questions
What is TYPO3-CORE-SA-2021-007?
TYPO3-CORE-SA-2021-007 is a vulnerability related to Cross-Site Scripting (XSS) in the Content Preview feature of TYPO3 CMS.
Which versions of TYPO3 CMS are affected by TYPO3-CORE-SA-2021-007?
TYPO3 CMS versions 10.0.0 to 10.4.14 and versions 11.0.0 to 11.1.1 are affected by TYPO3-CORE-SA-2021-007.
What is the severity of TYPO3-CORE-SA-2021-007?
The severity of TYPO3-CORE-SA-2021-007 is medium.
How can I fix TYPO3-CORE-SA-2021-007?
To fix TYPO3-CORE-SA-2021-007, you should update TYPO3 CMS to a version that includes the necessary security patches.
Where can I find more information about TYPO3-CORE-SA-2021-007?
You can find more information about TYPO3-CORE-SA-2021-007 on the TYPO3 security advisory page: https://typo3.org/security/advisory/typo3-core-sa-2021-007.