CSRF token exposure in TYPO3 extension

HIGH 7.5CVE-2021-36793 · GHSA-vpw5-grxx-v396 · Published 13/08/2021 · updated 17/06/2026

In short

CVE-2021-36793 is a HIGH (CVSS 7.5) vulnerability affecting lms/routes, routes (routes project).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.4% of all vulnerabilities.
Fix: update to 2.1.1 or later.

Package	Affected versions	Patched versions
lms/routes Packagist	`< 2.1.1`	`2.1.1`
routes routes_project	`< 2.1.1`	`2.1.1`

Description

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.

NVD description

The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.

References

nvd.nist.gov/vuln/detail/CVE-2021-36793 · ADVISORY
Lacr1ma/routes · PACKAGE
typo3.org/security/advisory/typo3-ext-sa-2021-008 · WEB
typo3.org/help/security-advisories/security · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free