Aimeos Typo3 extension contains Cross-site Scripting vulnerability

MEDIO 5.4CVE-2021-28380 · GHSA-73wv-rgj7-vjj9 · Published 16/03/2021 · updated 17/06/2026

In breve

CVE-2021-28380 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda aimeos/aimeos-typo3, aimeos (aimeos project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.56%, superiore al 46.5% delle vulnerabilità.
Correzione: aggiornare a 20.10.5, 19.10.12 o successiva.

Package	Affected versions	Patched versions
aimeos/aimeos-typo3 Packagist	`≥ 20.0.0, < 20.10.5< 19.10.12`	`20.10.519.10.12`
aimeos aimeos_project	`≥ 20.0.0, < 20.10.5< 19.10.12`	`20.10.519.10.12`

Description

The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows Cross-site Scripting (XSS) via a backend user account.

NVD description

The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.

References

nvd.nist.gov/vuln/detail/CVE-2021-28380 · ADVISORY
typo3.org/security/advisory/typo3-ext-sa-2021-003 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free