CVE-2021-41114

    Dashboard / Vulnerabilities / CVE-2021-41114

    CVE-2021-41114

    Published: 5 Oct 2021Last Modified: 27 Aug 2026

    Summary:

    Details: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

    References: https://github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphm, https://typo3.org/security/advisory/typo3-core-sa-2021-015, https://github.com/TYPO3/typo3/commit/5cbff85506cebe343e5ae59228977547cf8e3cf4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234
    Fixed -0da4bf2966784c088931dbe7f8b23bb981bf0065

    Affected versions

    v11.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41114 | CVE-DB