CVE-2021-32768: Cross-site Scripting

August 10, 2021 (updated August 19, 2021)

TYPO3 is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

References

nvd.nist.gov/vuln/detail/CVE-2021-32768
typo3.org/security/advisory/typo3-core-sa-2021-013

Code Behaviors & Features

Detect and mitigate CVE-2021-32768 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →