GHSA-vpw5-grxx-v396

Source

https://github.com/advisories/GHSA-vpw5-grxx-v396

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-vpw5-grxx-v396/GHSA-vpw5-grxx-v396.json

Aliases

• CVE-2021-36793

Published

2021-09-02T17:16:56Z

Modified

2023-11-08T04:06:16.675857Z

Details

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-36793
• https://github.com/Lacr1ma/routes
• https://typo3.org/security/advisory/typo3-ext-sa-2021-008