CSRF token exposure in TYPO3 extension

HOCH 7.5CVE-2021-36793 · GHSA-vpw5-grxx-v396 · Published 13/08/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-36793 ist eine Schwachstelle (HOCH (CVSS 7.5)) in lms/routes, routes (routes project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.0%, höher als bei 63.4% aller Schwachstellen.
Abhilfe: auf 2.1.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
lms/routes Packagist	`< 2.1.1`	`2.1.1`
routes routes_project	`< 2.1.1`	`2.1.1`

Description

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting in the frontend output.

NVD description

The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.

References

nvd.nist.gov/vuln/detail/CVE-2021-36793 · ADVISORY
Lacr1ma/routes · PACKAGE
typo3.org/security/advisory/typo3-ext-sa-2021-008 · WEB
typo3.org/help/security-advisories/security · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free