CVE-2021-31778: 
PHP vulnerability analysis and mitigation

The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows Cross-Site Scripting (XSS) vulnerability that can be exploited by a backend user account. The vulnerability was discovered and disclosed on April 27, 2021, affecting versions 1.0.0 through 1.3.2 of the extension (TYPO3 Advisory).

The vulnerability stems from the extension's failure to properly encode user input for output in HTML context. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

The vulnerability allows for Cross-Site Scripting attacks when exploited by users with backend access to the TYPO3 system. This could potentially lead to unauthorized access to sensitive information and compromise of user sessions (TYPO3 Advisory).

The vulnerability requires a valid TYPO3 backend user account to be exploited, which limits its potential impact. The attack complexity is considered low, but requires user interaction for successful exploitation (NVD).

The vulnerability has been patched in version 1.3.3 of the media2click extension. Users are advised to update to this version as soon as possible. The updated version is available through the TYPO3 extension manager, Packagist, and can be downloaded directly from the TYPO3 extension repository (TYPO3 Advisory).