PT-2021-23869

CVE-2021-43561

Published

2021-11-10

Updated

2021-11-16

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions google for jobs extension versions prior to 1.5.1 google for jobs extension versions 2.x prior to 2.1.1

Description An issue was discovered in the google for jobs extension where it fails to properly encode user input for output in HTML context, leading to a potential exploit. A TYPO3 backend user account is required to exploit this issue.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 or later. For versions 2.x prior to 2.1.1, update to version 2.1.1 or later.

Exploitability

Fix

Impacts

Researchers

Georg Ringer

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2021-43561