CVE-2021-21339

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-21346.5Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The suppCVE-2021-213405.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that databaCVE-2021-213417.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allCVE-2021-213429.1XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the pCVE-2021-213437.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the pCVE-2021-213449.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213459.9XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213469.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213479.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213487.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213498.6XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-21359.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that ar