Read the docs
TI-2021-17952 Aliases CVE-2021-41113GHSA-657m-v5vm-f6rw

Cross-Site-Request-Forgery in Backend URI Handling in Typo3

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system. To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. The following Same-Site cookie settings in $GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite] are required for an attack to be successful: SameSite=strict: malicious evil.example.org invoking TYPO3 application at good.example.org and SameSite=lax or none: malicious evil.com invoking TYPO3 application at example.org. Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

Why it matters now

EPSS 0.0064 50th percentileScored 2026-11-07
Fix Fixed typo3 (TYPO3): 11.5.0typo3/cms-core (Packagist): 11.5.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3typo311.2.0 to before 11.5.011.5.0Patch availableCNA
—typo3/cms-core (Packagist)11.2.0 to before 11.5.011.5.0Patch availableGHSA-657m-v5vm-f6rw
—typo3/cms (Packagist)11.2.0 to before 11.5.011.5.0Patch availableGHSA-657m-v5vm-f6rw
  • typo3 VendorTYPO3 Affected 11.2.0 to before 11.5.0 Fixed in 11.5.0 Patch available CNA
  • typo3/cms-core (Packagist) Vendor— Affected 11.2.0 to before 11.5.0 Fixed in 11.5.0 Patch available GHSA-657m-v5vm-f6rw
  • typo3/cms (Packagist) Vendor— Affected 11.2.0 to before 11.5.0 Fixed in 11.5.0 Patch available GHSA-657m-v5vm-f6rw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*11.2.0 to before 11.5.0VulnerableTYPO3
  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions 11.2.0 to before 11.5.0 Vulnerable ·TYPO3

Remediation

  • Fix · CNA typo3 (TYPO3) Fixed in 11.5.0
  • Fix · GHSA-657m-v5vm-f6rw typo3/cms-core (Packagist) Fixed in 11.5.0 Advisory →
  • Fix · GHSA-657m-v5vm-f6rw typo3/cms (Packagist) Fixed in 11.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41113
  2. 2026-10-03 Alias added: GHSA-657m-v5vm-f6rw
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 4

Other 4

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2009-00241 The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9… CVSS 2.0HIGH 10.0
  • TI-2020-08940 Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS CVSS 3.1CRITICAL 10.0
  • TI-2011-03994 Improper authentication in TYPO3 CVSS 3.1CRITICAL 9.8
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences