CVE-2021-21370

Cross-Site Scripting in Content Preview (CType menu)

MEDIUM

5.4

CVSS Score

Published: March 23, 2021 at 01:55 AM UTC

Updated: June 17, 2026 at 03:35 AM UTC

1 product affected across 1 vendorTYPO3

Using TYPO3.CMS by TYPO3?

Get instant alerts when new vulnerabilities affect TYPO3.CMS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.4

Exploit prediction

EPSS 0.9%

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

TYPO3 · TYPO3composer

95%

v ≤ 10.4.13v ≤ 11.1.0v ≤ 7.6.50v ≤ 8.7.39v ≤ 9.5.2410.0.0 ≤ v < 10.4.1411.0.0 ≤ v < 11.1.17.0.0 ≤ v < 7.6.518.0.0 ≤ v < 8.7.409.0.0 ≤ v < 9.5.25

Affected range stops below 10.4.14, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.6.51, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.40, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.5.25, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://typo3.org/security/advisory/typo3-core-sa-2021-008

References (3)

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x7hc-x7fm-f7qh

x_refsource_MISCRelease NotesThird Party Advisory

Source: [email protected]

https://packagist.org/packages/typo3/cms-backend

x_refsource_MISCVendor Advisory

Source: [email protected]

https://typo3.org/security/advisory/typo3-core-sa-2021-008

CVSS

5.4MEDIUMGitHub_M

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card