CVE-2021-21359CWE-405CWE-674

Denial of Service in Page Error Handling

Medium · published March 23, 2021

CVSS v3.1
5.9
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01731 · 77.4th percentile
Weaknesses
CWE-405 · Asymmetric Resource Consumption (Amplification); CWE-674 · Uncontrolled Recursion
Published
2021-03-23T01:55Z
EPSS history
Timeline
  • 23 MAR 01:55Z
    Denial of Service in Page Error Handling
    cvelistv5