What is CVE-2021-43562?

CVE-2021-43562 is a high-severity vulnerability in Pixxio Pixx.io, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.8/10. Published 2021-11-10.

How severe is CVE-2021-43562?

High severity. CVSS v3 base score is 8.8 out of 10.

SSRF in Pixxio Pixx.io

CVE-2021-43562

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.013 (68.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Pixxio Pixx.io
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-43562?: CVE-2021-43562 is a high-severity vulnerability in Pixxio Pixx.io, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.8/10. Published 2021-11-10.
How severe is CVE-2021-43562?: High severity. CVSS v3 base score is 8.8 out of 10.