CVE-2021-36787 Cross-site Scripting in the femanager TYPO3 extension
An attacker can execute arbitrary scripts in the victim's browser by uploading a crafted SVG document to the TYPO3 femanager extension.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-36787?
CVE-2021-36787 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Aug 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
Weakness: CWE-79
Which versions are affected by CVE-2021-36787?
4 open source packages ship an affected version, including in2code/femanager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
in2code/femanager Packagist | All versions | 5.5.1 |
in2code/femanager Packagist | All versions | 5.5.1 |
in2code/femanager Packagist | From 6.0.0 | 6.3.1 |
in2code/femanager Packagist | From 6.0.0 | 6.3.1 |
Products include In2code Femanager.
How do I fix CVE-2021-36787?
Upgrade in2code/femanager to a fixed version for your release line: 5.5.1 or 6.3.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-36787 being exploited?
There is no known exploitation of CVE-2021-36787 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-25013 Broken Access Control in 3rd party TYPO3 extension "femanager"
- CVE-2023-25014 Broken Access Control in 3rd party TYPO3 extension "femanager"
- CVE-2014-6292 TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users
- CVE-2022-44543 TYPO3 Extension femanager vulnerable to Broken Access Control
Sources
Also known as GHSA-f3rf-v9qm-9c89.