p PatchFirst

CVE-2021-21338

CVE-2021-21338 · Open Redirection in Login Handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.

CVSS 4.7 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3.cms

    Versions
    • >= 6.2.0, <= 6.2.56: Affected
    • >= 7.0.0, <= 7.6.50: Affected
    • >= 8.0.0, <= 8.7.39: Affected
    • >= 9.0.0, <= 9.5.24: Affected
    • >= 10.0.0, <= 10.4.13: Affected
    • >= 11.0.0, <= 11.1.0: Affected

    No fix published

  • typo3/cms-core Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 6.2.0, < 6.2.57

    Update to 6.2.57

  • typo3/cms-core Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.6.51

    Update to 7.6.51

  • typo3/cms-core Packagist

    Versions
    • v8.7.10
    • v8.7.11
    • v8.7.12
    • v8.7.13
    • v8.7.14
    • v8.7.15
    • v8.7.16
    • v8.7.17
    • v8.7.18
    • v8.7.19
    • v8.7.20
    • v8.7.21
    • v8.7.22
    • v8.7.23
    • v8.7.24
    • v8.7.25
    • v8.7.26
    • v8.7.27
    • v8.7.28
    • v8.7.29
    • v8.7.30
    • v8.7.31
    • v8.7.32
    • v8.7.7
    • v8.7.8
    • v8.7.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.7.40

    Update to 8.7.40

  • typo3/cms-core Packagist

    Versions
    • v10.0.0
    • v10.1.0
    • v10.2.0
    • v10.2.1
    • v10.2.2
    • v10.3.0
    • v10.4.0
    • v10.4.1
    • v10.4.10
    • v10.4.11
    • v10.4.12
    • v10.4.13
    • v10.4.2
    • v10.4.3
    • v10.4.4
    • v10.4.5
    • v10.4.6
    • v10.4.7
    • v10.4.8
    • v10.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 10.0.0, < 10.4.14

    Update to 10.4.14

  • typo3/cms-core Packagist

    Versions
    • v11.0.0
    • v11.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 11.0.0, < 11.1.1

    Update to 11.1.1

  • typo3/cms-core Packagist

    Versions
    • v9.0.0
    • v9.1.0
    • v9.2.0
    • v9.2.1
    • v9.3.0
    • v9.3.1
    • v9.3.2
    • v9.3.3
    • v9.4.0
    • v9.5.0
    • v9.5.1
    • v9.5.10
    • v9.5.11
    • v9.5.12
    • v9.5.13
    • v9.5.14
    • v9.5.15
    • v9.5.16
    • v9.5.17
    • v9.5.18
    • v9.5.19
    • v9.5.2
    • v9.5.20
    • v9.5.21
    • v9.5.22
    • v9.5.23
    • v9.5.24
    • v9.5.3
    • v9.5.4
    • v9.5.5
    • v9.5.6
    • v9.5.7
    • v9.5.8
    • v9.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0, < 9.5.25

    Update to 9.5.25

  • typo3/cms Packagist

    Versions
    • v10.0.0
    • v10.1.0
    • v10.2.0
    • v10.2.1
    • v10.2.2
    • v10.3.0
    • v10.4.0
    • v10.4.1
    • v10.4.10
    • v10.4.11
    • v10.4.12
    • v10.4.13
    • v10.4.2
    • v10.4.3
    • v10.4.4
    • v10.4.5
    • v10.4.6
    • v10.4.7
    • v10.4.8
    • v10.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 10.0.0, < 10.4.14

    Update to 10.4.14

  • typo3/cms Packagist

    Versions
    • v11.0.0
    • v11.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 11.0.0, < 11.1.1

    Update to 11.1.1

  • typo3/cms Packagist

    Versions
    • v9.0.0
    • v9.1.0
    • v9.2.0
    • v9.2.1
    • v9.3.0
    • v9.3.1
    • v9.3.2
    • v9.3.3
    • v9.4.0
    • v9.5.0
    • v9.5.1
    • v9.5.10
    • v9.5.11
    • v9.5.12
    • v9.5.13
    • v9.5.14
    • v9.5.15
    • v9.5.16
    • v9.5.17
    • v9.5.18
    • v9.5.19
    • v9.5.2
    • v9.5.20
    • v9.5.21
    • v9.5.22
    • v9.5.23
    • v9.5.24
    • v9.5.3
    • v9.5.4
    • v9.5.5
    • v9.5.6
    • v9.5.7
    • v9.5.8
    • v9.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0, < 9.5.25

    Update to 9.5.25

Original sources

Check your server →