CVE-2021-32667: 
PHP vulnerability analysis and mitigation

TYPO3, an open source PHP-based web content management system, was found to contain a cross-site scripting vulnerability (CVE-2021-32667) affecting versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0. The vulnerability was discovered and disclosed on July 20, 2021, and patches were released in versions 9.5.29, 10.4.18, and 11.3.1 (TYPO3 Advisory, GitHub Advisory).

The vulnerability exists in the page preview module (Web>View) where Page TSconfig settings are not properly encoded, leading to persistent cross-site scripting. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability allows for persistent cross-site scripting attacks, potentially leading to unauthorized access to sensitive information and manipulation of web content. However, the impact is somewhat limited as it requires a valid backend user account to exploit the vulnerability (TYPO3 Advisory).

The recommended mitigation is to update to the patched versions: TYPO3 9.5.29, 10.4.18, or 11.3.1. Users are advised to follow the recommendations provided in the TYPO3 Security Guide and subscribe to the typo3-announce mailing list for future security updates (TYPO3 Advisory).