{"id":"CVE-2021-36793","aliases":["EUVD-2021-2116","GHSA-vpw5-grxx-v396"],"status":"published","title":"CSRF token exposure in TYPO3 extension","description":"The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01013,"percentile":0.63645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-668"],"published":"2021-08-13T16:20:00Z","modified":"2026-06-17T03:59:26Z","fixes":[{"ecosystem":"Packagist","package":"lms/routes","fixed_in":["2.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"lms/routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"lms/routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}],"versions":["v1.3.3","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.5.10","v1.5.2","v1.5.3","v1.5.4","v1.5.5","v1.5.6","v1.5.7","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.7.0","v1.8.0","v1.8.1","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v2.0.0","v2.1.0"]}],"products":[{"vendor":"routes_project","product":"routes"}],"references":[{"url":"https://typo3.org/help/security-advisories/security","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2021-008","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36793","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vpw5-grxx-v396"},{"url":"https://github.com/Lacr1ma/routes","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-36793","description":"The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.","status":"published","published":"2021-08-13T16:20:00Z","modified":"2024-08-04T01:01:59.216Z","updated_at":"2026-11-02T14:33:05.989686Z"}],"euvd":[{"id":"EUVD-2021-2116","description":"The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.","status":"published","published":"2021-08-13T16:20:00Z","modified":"2024-08-04T01:01:59Z","updated_at":"2026-11-03T03:24:29.329171Z"}],"ghsa":[{"id":"GHSA-vpw5-grxx-v396","title":"CSRF token exposure in TYPO3 extension","description":"When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.","status":"published","published":"2021-09-02T17:16:56Z","modified":"2023-01-27T05:02:04Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","level":"medium"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2021-36793","description":"The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.","status":"published","published":"2021-08-13T17:15:16.823Z","modified":"2026-06-17T03:59:26.73Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"GHSA-vpw5-grxx-v396","title":"CSRF token exposure in TYPO3 extension","description":"When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.","status":"published","published":"2021-09-02T17:16:56Z","modified":"2023-11-08T04:06:16.675857Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","level":"medium"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}