CVE Vulnerabilities

CVE-2021-21339

Cleartext Storage of Sensitive Information

Published: Mar 23, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.

Weakness

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Affected Software

Name Vendor Start Version End Version
Typo3 Typo3 6.2.0 (including) 6.2.57 (excluding)
Typo3 Typo3 7.0.0 (including) 7.6.51 (excluding)
Typo3 Typo3 8.0.0 (including) 8.7.40 (excluding)
Typo3 Typo3 9.0.0 (including) 9.5.25 (excluding)
Typo3 Typo3 10.0.0 (including) 10.4.14 (excluding)
Typo3 Typo3 11.0.0 (including) 11.1.1 (excluding)

Potential Mitigations

References