Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

TYPO3: Unencoded Settings Allow Malicious Code Injection

CVE-2021-32667 · published 5 years ago
Summary

TYPO3 versions 9.0.0 to 11.3.0 have a security flaw that can allow hackers to inject malicious code into websites using a valid backend user account. This can happen when certain settings are not properly encoded. Users should update to versions 9.5.29, 10.4.18, or 11.3.1 to fix the issue.

What to do
  • Update typo3 cms-core to version 9.5.28.
  • Update typo3 cms-core to version 10.4.18.
  • Update typo3 cms-core to version 11.3.1.
  • Update typo3 cms to version 10.4.18.
  • Update typo3 cms to version 11.3.1.
  • Update typo3 cms to version 9.5.28.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms-core >= 9.0.0, < 9.5.28
>= 10.0.0, < 10.4.18
>= 11.0.0, < 11.3.1
Fix: upgrade to 9.5.28
composer typo3 cms >= 10.0.0, < 10.4.18
>= 11.0.0, < 11.3.1
>= 9.0.0, < 9.5.28
Fix: upgrade to 10.4.18
– typo3 typo3 >= 9.0.0, <= 9.5.287
>= 10.0.0, <= 10.4.17
>= 11.0.0, <= 11.3.0
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Original advisory text
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Pa...
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Jul 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-8mq9-fqv8-59wf · GHSA
CVE-2021-32667 · NVD
CVE-2021-32667 · OSV
Track software like this
Free during beta