CVE-2021-41114— TYPO3 安全漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2021-41114 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
HTTP Host Header Injection in Request Handling in Typo3
来源: CVE Program / CVE List V5
Vulnerability Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
来源: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
TYPO3 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
TYPO3是瑞士TYPO3（Typo3）协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3 v11版本存在安全漏洞，该漏洞源于缺少对于HTTP主机报头的有效验证，TYPO3 CMS很容易受到主机欺骗。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2021-41114 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2021-41114 的情报信息
请登录查看更多情报信息。
CVE-2021-41114 厂商安全公告 (1)
- https://github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphmx_refsource_CONFIRM
CVE-2021-41114 其他参考 (1)
- https://typo3.org/security/advisory/typo3-core-sa-2021-015x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2021-41114
暂无评论