CVE-2021-36793

HIGH

routes < 2.1.1 - Sensitive Information Disclosure via CsrfTokenViewHelper

Title source: llm

Description

The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://typo3.org/help/security-advisories/security

Vendor Advisory x_refsource_confirm

https://typo3.org/security/advisory/typo3-ext-sa-2021-008

Scores

CVSS v3 7.5

EPSS 0.0101

EPSS Percentile 58.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

lms/routes 0 - 2.1.1Packagist

routes_project/routes < 2.1.1

Published Aug 13, 2021

Tracked Since Feb 18, 2026