CVE-2021-41113: Cross-Site-Request-Forgery in TYPO3 CMS-Core
Summary
CVE-2021-41113: Cross-Site-Request-Forgery in Backend. Affects typo3/cms-core versions >= 11.2.0, < 11.5.0. Fixed in 11.5.0. How to fix ↓
Also tracked for
- typo3 · Bitnami
The same CVE-2021-41113 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a backend user interface for administrators to perform various tasks, including creating and sharing deep links. These deep links allow users to access specific sections or pages within the backend interface. However, a vulnerability has been discovered in TYPO3 CMS-Core version 11.2.0, which makes it susceptible to cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in TYPO3 CMS-Core allows an attacker to trick a victim into performing unintended actions on the compromised system. The vulnerability is similar to the one described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069), but with a broader impact. Unlike the previous version, this vulnerability does not require the attacker to be authenticated and can be exploited across different site contexts. In the worst-case scenario, an attacker could create a new admin user account to compromise the entire system. To successfully carry out an attack, the victim must have an active session in the TYPO3 backend and be tricked into accessing the compromised system.
How To Fix
Minimum fixed version
11.5.0
This is the first release that contains the fix.
composer require typo3/cms-core:11.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The CSRF vulnerability in TYPO3 CMS-Core can have severe consequences, including unauthorized access and compromise of the entire system. It is crucial to update your TYPO3 CMS-Core installation to the latest version (11.5.0 or later) to mitigate this vulnerability. Regularly updating your software and following security best practices will help protect your system from known vulnerabilities. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a backend user interface for administrators to perform various tasks.
A CSRF attack, or cross-site request forgery attack, is a type of security exploit where an attacker tricks a victim into performing unintended actions on a web application in which the victim is authenticated.
The CSRF vulnerability in TYPO3 CMS-Core allows an attacker to perform unauthorized actions on the compromised system. This can lead to data breaches, unauthorized access, and potential compromise of the entire system.
Unlike the previous version, this CSRF vulnerability in TYPO3 CMS-Core does not require the attacker to be authenticated. However, the victim must have an active session in the TYPO3 backend for the attack to be successful.
To protect your TYPO3 CMS-Core installation, it is recommended to update to the latest version (11.5.0 or later) that addresses the CSRF vulnerability. Additionally, it is important to follow security best practices, such as regularly updating your software, using strong passwords, and implementing proper access controls.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
