GitHub Advisoryadvisory · Packagist

GHSA-34fr-fhqr-7235 Information Disclosure in User Authentication

MEDIUM Published 2021-07-26 Modified 2021-08-31 Official page ↗
Aliases
CVE-2021-32767
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2021-07-22

Affected packages

• Packagist typo3/cms-core: >= 7.0.0, < 7.6.52 → fixed in 7.6.52 • Packagist typo3/cms-core: >= 8.0.0, < 8.7.41 → fixed in 8.7.41 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.28 → fixed in 9.5.28 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.18 → fixed in 10.4.18 • Packagist typo3/cms-core: >= 11.0.0, < 11.3.1 → fixed in 11.3.1 • Packagist typo3/cms: >= 10.0.0, < 10.4.18 → fixed in 10.4.18 • Packagist typo3/cms: >= 11.0.0, < 11.3.1 → fixed in 11.3.1 • Packagist typo3/cms: >= 9.0.0, < 9.5.28 → fixed in 9.5.28

Description

> ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration. Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue. References • TYPO3-CORE-SA-2021-012

Related

Alias · CVE (1)

  • CVE-2021-32767 TYPO3 is an open source PHP based web content management system. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References