CVE-2021-32668
Cross-Site Scripting in Query Generator & Query View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting in Query Generator & Query View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Record
CVE-2021-32668- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-1445
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Record
EUVD-2021-1445- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mh3-j5r5-2379
Cross-Site Scripting in Query Generator & Query View
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(4.5)
Problem
Failing to properly encode error messages, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.
Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.
References
- Record
GHSA-6mh3-j5r5-2379- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Record
CVE-2021-32668- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Record
CVE-2021-32668- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-6mh3-j5r5-2379
Cross-Site Scripting in Query Generator & Query View
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(4.5)
Problem
Failing to properly encode error messages, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.
Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.
References
- Record
GHSA-6mh3-j5r5-2379- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-typo3-2021-32668 No score
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
- Record
BIT-typo3-2021-32668- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
8.0.0 up to 8.7.41 | 8.7.41 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.28 | 9.5.28 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.18 | 10.4.18 |
typo3/cms-corePackagist |
11.0.0 up to 11.3.1 | 11.3.1 |
typo3/cmsPackagist |
10.0.0 up to 10.4.18 | 10.4.18 |
typo3/cmsPackagist |
11.0.0 up to 11.3.1 | 11.3.1 |
typo3/cmsPackagist |
9.0.0 up to 9.5.28 | 9.5.28 |
typo3Bitnami |
8.0.0 up to 8.7.40, 9.0.0 up to 9.5.28, 10.0.0 up to 10.4.17, 11.0.0 up to 11.3.0 | 8.7.409.5.2810.4.1711.3.0 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.41, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 21 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.30v8.7.31v8.7.32v8.7.7v8.7.8v8.7.9 |
8.7.41 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.28, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 32 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.28 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.4.18, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 19 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.18 |
typo3/cms-corePackagist |
11.0.0 up to 11.3.1, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 |
11.3.1 |
typo3/cmsPackagist |
10.0.0 up to 10.4.18, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 19 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.18 |
typo3/cmsPackagist |
11.0.0 up to 11.3.1, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 |
11.3.1 |
typo3/cmsPackagist |
9.0.0 up to 9.5.28, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 32 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32668 is a medium vulnerability (CVSS 6.4) in Typo3, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in typo3/cms-core 8.7.41.
References
github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379
typo3.org/security/advisory/typo3-core-sa-2021-010
nvd.nist.gov/vuln/detail/CVE-2021-32668