Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-jjbn-6efk-nud2
Vulnerability ID VCID-jjbn-6efk-nud2
Aliases CVE-2021-41113
GHSA-657m-v5vm-f6rw
Summary Cross-Site Request Forgery (CSRF) TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-309 Use of Password System for Primary Authentication
CWE-352 Cross-Site Request Forgery (CSRF)
System Score Found at
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2021-41113
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-657m-v5vm-f6rw
cvssv3.1 8.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml
cvssv3.1 8.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml
cvssv3.1 8.8 https://github.com/TYPO3/typo3
generic_textual HIGH https://github.com/TYPO3/typo3
cvssv3.1 8.8 https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f
generic_textual HIGH https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f
cvssv3.1 8.8 https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw
cvssv3.1_qr HIGH https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw
generic_textual HIGH https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2020-11069
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-11069
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2021-41113
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-41113
cvssv3.1 8.8 https://typo3.org/security/advisory/typo3-core-sa-2020-006
generic_textual HIGH https://typo3.org/security/advisory/typo3-core-sa-2020-006
cvssv3.1 8.8 https://typo3.org/security/advisory/typo3-core-sa-2021-014
generic_textual HIGH https://typo3.org/security/advisory/typo3-core-sa-2021-014
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-41113
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml
https://github.com/TYPO3/typo3
https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f
https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw
https://nvd.nist.gov/vuln/detail/CVE-2020-11069
https://typo3.org/security/advisory/typo3-core-sa-2020-006
https://typo3.org/security/advisory/typo3-core-sa-2021-014
CVE-2021-41113 https://nvd.nist.gov/vuln/detail/CVE-2021-41113
GHSA-657m-v5vm-f6rw https://github.com/advisories/GHSA-657m-v5vm-f6rw
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3/typo3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11069
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41113
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://typo3.org/security/advisory/typo3-core-sa-2020-006
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://typo3.org/security/advisory/typo3-core-sa-2021-014
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.47627
EPSS Score 0.00244
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:48:54.067560+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-core/CVE-2021-41113.yml 38.0.0