CVE-2021-21359

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-405 CWE-674

Affected software

Vendor	Product	Versions
TYPO3	TYPO3.CMS	>= 9.0.0, <= 9.5.24; >= 10.0.0, <= 10.4.13; >= 11.0.0, <= 11.1.0

References

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397pThird Party Advisory
https://packagist.org/packages/typo3/cms-coreRelease Notes, Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2021-005Vendor Advisory
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397pThird Party Advisory
https://packagist.org/packages/typo3/cms-coreRelease Notes, Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2021-005Vendor Advisory

Timeline

Published: Mar 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-21369.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-213605.3Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.G CVE-2021-213616.5The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system env CVE-2021-213626.5MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO befo CVE-2021-213637.0swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in CVE-2021-213645.5swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in CVE-2021-213655.4Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site sc CVE-2021-213664.3xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do CVE-2021-213678.1Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerabilit CVE-2021-213688.8msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototy CVE-2021-213696.5Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-s CVE-2021-21378.8Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions