CVE-2021-21339: 
PHP vulnerability analysis and mitigation

TYPO3 CMS, an open source PHP-based web content management system, was found to have a sensitive data exposure vulnerability (CVE-2021-21339) discovered on March 16, 2021. The vulnerability affected multiple versions from 6.2.0 through 11.1.0, where user session identifiers were stored in cleartext without additional cryptographic hashing algorithms (TYPO3 Advisory).

The vulnerability was classified as CWE-312 (Cleartext Storage of Sensitive Information). It received a CVSS v3.1 base score of 7.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N according to NVD assessment. The vulnerability specifically affected the Session Storage component in the TYPO3 core module (NVD).

While this vulnerability cannot be exploited directly, it becomes dangerous when combined with other attack vectors such as SQL injection in any other component of the system. The exposure of session identifiers in cleartext could potentially lead to unauthorized access to user sessions (TYPO3 Advisory).

The vulnerability was fixed in TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1. Users are advised to update to these patched versions to resolve the security issue. TYPO3 also recommends following the recommendations provided in the TYPO3 Security Guide and subscribing to the typo3-announce mailing list for security updates (TYPO3 Advisory).