CVE-2021-21359: Denial of Service in Page Error Handling
### Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C (5.5) CWE-405, CWE-674 Status: DRAFT
Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.
Solution Update to TYPO3 versions 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Credits Thanks to Paul Keller, Mathias Bolt Lesniak and Kay Strobach who reported this issue and to TYPO3 framework merger Frank Nägler and to TYPO3 security team member Torben Hansen who fixed the issue.
References TYPO3-CORE-SA-2021-005
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.
TYPO3-CORE-SA-2021-005: Denial of Service in Page Error Handling
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21359?
CVE-2021-21359 is a vulnerability in TYPO3 that allows for Denial of Service in Page Error Handling.
How does CVE-2021-21359 impact TYPO3?
CVE-2021-21359 can result in a Denial of Service attack on TYPO3 installations.
Which versions of TYPO3 are affected by CVE-2021-21359?
TYPO3 versions 10.0.0 to 10.4.14, 11.0.0 to 11.1.1, and 9.0.0 to 9.5.25 are affected by CVE-2021-21359.
How can I fix CVE-2021-21359 in TYPO3?
To fix CVE-2021-21359 in TYPO3, update to a version that includes the security patch provided by TYPO3.
Where can I find more information about TYPO3-CORE-SA-2021-005?
You can find more information about TYPO3-CORE-SA-2021-005 on the TYPO3 website at [https://typo3.org/security/advisory/typo3-core-sa-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005).