CVE-2021-21339
Published Mar 23, 2021
Last updated 4 years ago
Overview
- Description
- TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- security-advisories@github.com
- CWE-312
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E257D831-1E13-4091-B658-176CBD37B426",
"versionEndExcluding": "6.2.57",
"versionStartIncluding": "6.2.0"
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "518930A7-E255-4A56-B76B-1C978A236856",
"versionEndExcluding": "7.6.51",
"versionStartIncluding": "7.0.0"
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F10B90F0-DA5C-4A80-BD4F-124B6C82CE8B",
"versionEndExcluding": "8.7.40",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CB3125B-114D-4991-BD60-9535D97DD348",
"versionEndExcluding": "9.5.25",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C031A87F-5A82-48F8-AB02-FED0CDFE08A2",
"versionEndExcluding": "10.4.14",
"versionStartIncluding": "10.0.0"
},
{
"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F696292E-3CC6-416B-9F99-6C1287B1D78D",
"versionEndExcluding": "11.1.1",
"versionStartIncluding": "11.0.0"
}
],
"operator": "OR"
}
]
}
]