CVE-2021-21370: Cross-Site Scripting in Content Preview (CType menu)
Problem It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.
Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Credits Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.
References TYPO3-CORE-SA-2021-008
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
TYPO3-CORE-SA-2021-008: Cross-Site Scripting in Content Preview
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21370?
CVE-2021-21370 is a vulnerability in TYPO3 CMS that allows for cross-site scripting (XSS) attacks in the content preview feature.
How does CVE-2021-21370 impact TYPO3 CMS?
CVE-2021-21370 can potentially allow an attacker to execute arbitrary JavaScript code in the context of a victim's web browser, leading to potential information theft or unauthorized actions.
Which versions of TYPO3 CMS are affected by CVE-2021-21370?
TYPO3 CMS versions 10.0.0 to 10.4.14, 11.0.0 to 11.1.1, and 9.0.0 to 9.5.25 are affected by CVE-2021-21370.
How can I fix CVE-2021-21370 in TYPO3 CMS?
To fix CVE-2021-21370, update TYPO3 CMS to versions 10.4.15, 11.1.2, or 9.5.26 or later, as these versions contain the necessary security patches.
Where can I find more information about CVE-2021-21370?
More information about CVE-2021-21370 can be found in the TYPO3 security advisory TYPO3-CORE-SA-2021-008 (https://typo3.org/security/advisory/typo3-core-sa-2021-008).