CVE-2021-32768 Cross-Site Scripting via Rich-Text Content
Attackers can inject malicious scripts into TYPO3 frontend via rich-text content, potentially leading to code execution or account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32768?
CVE-2021-32768 is a medium-severity cross-site scripting vulnerability in Typo3 Typo3, published on 10 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
Weakness: CWE-79
Which versions are affected by CVE-2021-32768?
21 open source packages ship an affected version, including typo3/cms, typo3 and typo3/cms-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms Packagist | From 10.0.0 | 10.4.19 |
typo3/cms Packagist | From 10.0.0 | 10.4.19 |
typo3/cms Packagist | From 11.0.0 | 11.3.2 |
typo3/cms Packagist | From 11.0.0 | 11.3.2 |
typo3/cms Packagist | From 7.0.0 | 7.6.53 |
typo3/cms Packagist | From 7.0.0 | 7.6.53 |
15 more packages
typo3/cms Packagist | From 8.0.0 | 8.7.42 |
typo3/cms Packagist | From 8.0.0 | 8.7.42 |
typo3/cms Packagist | From 9.0.0 | 9.5.29 |
typo3/cms Packagist | From 9.0.0 | 9.5.29 |
typo3 Bitnami | From 7.0.0 | 7.6.52, 8.7.41, 9.5.28, 10.4.18, 11.3.1 |
typo3/cms-core Packagist | From 10.0.0 | 10.4.19 |
typo3/cms-core Packagist | From 10.0.0 | 10.4.19 |
typo3/cms-core Packagist | From 11.0.0 | 11.3.2 |
typo3/cms-core Packagist | From 11.0.0 | 11.3.2 |
typo3/cms-core Packagist | From 7.0.0 | 7.6.53 |
typo3/cms-core Packagist | From 7.0.0 | 7.6.53 |
typo3/cms-core Packagist | From 8.0.0 | 8.7.42 |
typo3/cms-core Packagist | From 8.0.0 | 8.7.42 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.29 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.29 |
Products include Typo3 Typo3.
How do I fix CVE-2021-32768?
Upgrade typo3/cms to a fixed version for your release line: 10.4.19, 11.3.2, 7.6.53 or 8.7.42.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-32768 being exploited?
There is no known exploitation of CVE-2021-32768 in the wild and no public exploit code.
Other vulnerabilities in Typo3 Typo3
- CVE-2009-0258 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- CVE-2011-3583 Typo3 SQL injection due to faulty prepared statements
- CVE-2011-4628 Typo3 Authentication Bypass
- CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Sources
Also known as BIT-typo3-2021-32768, GHSA-c5c9-8c6m-727v.