What’s Vulnerable › Vulnerabilities

CVE-2021-21365: Cross-Site Scripting in Content Rendering

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-27 · updated 2026-06-17
• Weakness: CWE-79

Description

Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.

Affected products

• typo3: before 7.1.2; from 8.0.0 before 8.0.8; from 9.0.0 before 9.0.4; from 9.1.0 before 9.1.3; from 10.0.0 before 10.0.10; from 11.0.0 before 11.0.3 — fixed in 10.0.10, 11.0.3, 7.1.2, 8.0.8, 9.0.4, 9.1.3

How to fix

Upgrade to a fixed version: typo3 10.0.10, 11.0.3, 7.1.2, 8.0.8. Check the vendor advisory for mitigations.

References

• https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b
• https://github.com/benjaminkott/bootstrap_package/security/advisories/GHSA-p48w-vf3c-rqjx
• https://typo3.org/security/advisory/typo3-ext-sa-2021-007
• https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b
• https://github.com/benjaminkott/bootstrap_package/security/advisories/GHSA-p48w-vf3c-rqjx
• https://typo3.org/security/advisory/typo3-ext-sa-2021-007

Get alerted when CVE-2021-21365 or the next vulnerability affects your stack