Vulnerability Database

289,871

Total vulnerabilities in the database

CVE-2021-21339

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
typo3 / typo3 11.0.0 11.1.1
typo3 / typo3 10.0.0 10.4.14
typo3 / typo3 9.0.0 9.5.25
typo3 / typo3 8.0.0 8.7.40
typo3 / typo3 7.0.0 7.6.51
typo3 / typo3 6.2.0 6.2.57
typo3 / cms-core 6.2.0 6.2.57
typo3 / cms-core 7.0.0 7.6.51
typo3 / cms-core 8.0.0 8.7.40
typo3 / cms-core 9.0.0 9.5.25
typo3 / cms-core 10.0.0 10.4.14
typo3 / cms-core 11.0.0 11.1.1