CVE-2021-31779: 
PHP vulnerability analysis and mitigation

The yoast_seo (aka Yoast SEO) extension before version 7.2.1 for TYPO3 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability that could be exploited via a backend user account. The vulnerability was disclosed on April 27, 2021 (TYPO3 Advisory).

The vulnerability was classified as medium severity with a CVSS v3.1 base score of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The extension failed to properly restrict analyzed URLs to domains managed by the current TYPO3 website, allowing authenticated backend users to make HTTP requests to arbitrary domains, including the webserver itself or other internally managed resources (TYPO3 Advisory).

The vulnerability could allow authenticated attackers to make unauthorized HTTP requests to internal resources and arbitrary external domains, potentially leading to information disclosure and server-side request forgery attacks (TYPO3 Advisory).

The vulnerability requires authentication with a backend user account to exploit. The attack complexity is considered low, requiring no user interaction beyond having the necessary login credentials (NVD Database).

Users are advised to update to version 7.2.1 or later of the Yoast SEO extension, which is available through the TYPO3 extension manager, Packagist, and the TYPO3 extension repository. The fix was provided by MaxServ BV (TYPO3 Advisory).