CVE-2021-21359

Denial of Service in Page Error Handling

State: Published
Severity: 5.9 Medium
Published: Mar 23, 2021
Updated: Aug 3, 2024
Reserved: Dec 22, 2020

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-674 Uncontrolled Recursion
CWE-405 Asymmetric Resource Consumption (Amplification)

Affected Products

Product	Versions
TYPO3.CMSTYPO3	>= 9.0.0, <= 9.5.24Affected >= 10.0.0, <= 10.4.13Affected >= 11.0.0, <= 11.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.