Improper Resource Shutdown or Release in TYPO3 extension

ÉLEVÉE 7.5CVE-2021-38623 · GHSA-34jq-548x-m2x9 · Published 13/08/2021 · updated 17/06/2026

En bref

CVE-2021-38623 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant webcoast/deferred-image-processing, deferred image processing (deferred image processing project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.96%, plus élevée que 61.8% des vulnérabilités.
Correctif : mettre à jour vers 1.0.2 ou plus récent.

Package	Affected versions	Patched versions
webcoast/deferred-image-processing Packagist	`< 1.0.2`	`1.0.2`
deferred image processing deferred_image_processing_project	`< 1.0.2`	`1.0.2`

Description

Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.

NVD description

The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.

References

nvd.nist.gov/vuln/detail/CVE-2021-38623 · ADVISORY
webcoast-dk/deferred-image-processing · PACKAGE
typo3.org/security/advisory/typo3-ext-sa-2021-009 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free