CVE-2021-36793
CSRF token exposure in TYPO3 extension
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
- Record
CVE-2021-36793- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
- Record
CVE-2021-36793- Updated
- 2026-11-02
EUVDEUVD-2021-2116 No score
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
- Record
EUVD-2021-2116- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vpw5-grxx-v396
CSRF token exposure in TYPO3 extension
When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.
- Record
GHSA-vpw5-grxx-v396- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVGHSA-vpw5-grxx-v396
CSRF token exposure in TYPO3 extension
When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.
- Record
GHSA-vpw5-grxx-v396- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C - Weakness
- CWE-668
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lms/routesPackagist |
before 2.1.1 | 2.1.1 |
lms/routesPackagist |
before 2.1.1, plus listed versions v1.3.3v1.4.0v1.4.1v1.5.0v1.5.1 Show 22 moreShow lessv1.5.10v1.5.2v1.5.3v1.5.4v1.5.5v1.5.6v1.5.7v1.6.0v1.6.1v1.6.2v1.6.3v1.7.0v1.8.0v1.8.1v1.8.2v1.8.3v1.8.4v1.8.5v1.8.6v1.8.7v2.0.0v2.1.0 |
2.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36793 is a high vulnerability (CVSS 7.5) in Routes Project Routes, published August 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in lms/routes 2.1.1.