Dear TYPO3 users,
several vulnerabilities have been found in the following third party TYPO3
extensions:
"Extbase Yaml Routes" (routes)
"Deferred image processing" (deferred_image_processing)
"femanager" (femanager)
"Miniorange Saml" (miniorange_saml)
"Yoast SEO for TYPO3" (yoast_seo)
"Dated News" (dated_news)
"Newsletter" (newsletter)
For further information on the issues, please read the related advisories
TYPO3-EXT-SA-2021-008, TYPO3-EXT-SA-2021-009, TYPO3-EXT-SA-2021-010,
TYPO3-EXT-SA-2021-011, TYPO3-EXT-SA-2021-012, TYPO3-EXT-SA-2021-013 and
TYPO3-EXT-SA-2021-014 which were published today:
TYPO3-EXT-SA-2021-008: Sensitive Information Disclosure in “Extbase Yaml
Routes” (routes)
[1]TYPO3-EXT-SA-2021-008: Sensitive Information Disclosure in “Extbase Yaml Routes” (routes)
TYPO3-EXT-SA-2021-009: Denial of Service in Extension "Deferred image
processing" (deferred_image_processing)
[2]TYPO3-EXT-SA-2021-009: Denial of Service in Extension "Deferred image processing" (deferred_image_processing)
TYPO3-EXT-SA-2021-010: Cross Site Scripting in Extension "femanager"
(femanager)
[3]TYPO3-EXT-SA-2021-010: Cross-Site Scripting in Extension "femanager" (femanager)
TYPO3-EXT-SA-2021-011: Multiple vulnerabilities in Extension "Miniorange Saml"
(miniorange_saml)
[4]TYPO3-EXT-SA-2021-011: Multiple vulnerabilities in Extension "Miniorange Saml" (miniorange_saml)
TYPO3-EXT-SA-2021-012: Cross Site Scripting in Extension "Yoast SEO for TYPO3"
(yoast_seo)
[5]TYPO3-EXT-SA-2021-012: Cross Site Scripting in Extension "Yoast SEO for TYPO3" (yoast_seo)
TYPO3-EXT-SA-2021-013: Multiple vulnerabilities in Extension "Dated News"
(dated_news)
[6]TYPO3-EXT-SA-2021-013: Multiple vulnerabilities in Extension "Dated News" (dated_news)
TYPO3-EXT-SA-2021-014: SQL Injection in extension "Newsletter" (newsletter)
[7]TYPO3-EXT-SA-2021-014: SQL Injection in extension "Newsletter" (newsletter)
In general the TYPO3 Security Team recommends to read the following pages:
The TYPO3 Security Guide:
[8]https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html
Make sure you are subscribed to the TYPO3 Announce List:
[9]TYPO3-announce Info Page
See all TYPO3 security advisories:
[10]TYPO3 Security Bulletins
Regards,
Torben Hansen
Member of the TYPO3 Security Team