CVE-2021-21359

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Asymmetric Resource Consumption (Amplification) pada typo3. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-405: Asymmetric Resource Consumption (Amplification)
CWE-674: Uncontrolled Recursion

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://typo3.org/security/advisory/typo3-core-sa-2021-005 advisory vendor
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397p advisory pihak ketiga
• https://packagist.org/packages/typo3/cms-core release notes · advisory pihak ketiga