Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

TYPO3 Form Designer Module Allows Hackers to Inject Malicious Code

CVE-2021-21358 · published 5 years ago
Summary

A security flaw in the Form Designer module of TYPO3's Form Framework allows an attacker with a valid backend user account to inject malicious code into the website. This could lead to unauthorized access or data theft. To fix this issue, update to TYPO3 versions 10.4.14 or 11.1.1.

What to do
  • Update typo3 cms-form to version 10.4.14.
  • Update typo3 cms-form to version 11.1.1.
  • Update typo3 cms-core to version 10.4.14.
  • Update typo3 cms-core to version 11.1.1.
  • Update typo3 cms to version 10.4.14.
  • Update typo3 cms to version 11.1.1.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms-form >= 10.2.0, <= 10.4.13
>= 11.0.0, <= 11.1.0
Fix: upgrade to 10.4.14
composer typo3 cms-core >= 10.0.0, < 10.4.14
>= 11.0.0, < 11.1.1
Fix: upgrade to 10.4.14
composer typo3 cms >= 10.0.0, < 10.4.14
>= 11.0.0, < 11.1.1
Fix: upgrade to 10.4.14
– typo3 typo3 >= 10.2.0, < 10.4.14
>= 11.0.0, < 11.1.1
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Original advisory text
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulne...
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Mar 2021
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x79j-wgqv-g8h2 · GHSA
CVE-2021-21358 · NVD
Track software like this
Free during beta