{"cve":"CVE-2021-43563","nvd":{"published":"2021-11-10T16:15:09.343","modified":"2026-06-17T04:11:08.557","status":"Modified","description":"An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":[],"references":["https://typo3.org/security/advisory/typo3-ext-sa-2021-017","https://typo3.org/security/advisory/typo3-ext-sa-2021-017"],"products":["pixxio:pixx.io"],"source":"nvd","synced_at":"2026-10-19T21:24:39.218183596+00:00"},"epss":{"cve":"CVE-2021-43563","score":0.00988,"percentile":0.62492,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}