CVE-2021-36793: Exposure of Resource to Wrong Sphere

September 2, 2021

The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.

References

github.com/advisories/GHSA-vpw5-grxx-v396
nvd.nist.gov/vuln/detail/CVE-2021-36793
typo3.org/security/advisory/typo3-ext-sa-2021-008

Code Behaviors & Features

Detect and mitigate CVE-2021-36793 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →