Detections
Analytics

SCA: security update for typo3/cms, typo3/cms-core, typo3/cms-form (GHSA-3vg7-jw9m-pc3f)

high Tenable Self-Hosted Container Security Plugin ID 409700

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25,
 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options
 and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default
 configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for
 file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or
 _malicious.php_. Besides that, attackers can persist those files in any writable directory of the
 corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to
 exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1. (CVE-2021-21357)

See Also

https://github.com/advisories/GHSA-3vg7-jw9m-pc3f

Plugin Details

Severity: High

ID: 409700

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2021-21357

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/23/2021

Vulnerability Publication Date: 3/23/2021

Reference Information

CVE: CVE-2021-21357