Information Disclosure in User Authentication
CVE-2021-32767

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3.cms
Vendor
CVE Published:
20 July 2021

What is CVE-2021-32767?

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

Affected Version(s)

TYPO3.CMS >= 9.0.0, < 9.5.28 < 9.0.0, 9.5.28

TYPO3.CMS >= 10.0.0, < 10.4.18 < 10.0.0, 10.4.18

TYPO3.CMS >= 11.0.0, < 11.3.1 < 11.0.0, 11.3.1

References

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GH...
x_refsource_CONFIRM
https://typo3.org/security/advisory/typo3-core-sa-2021-012
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.