Most recent entries from all

cnvd-2022-17984

EUVD-2026-28140

fkie_cve-2021-32767

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

GHSA-34fr-fhqr-7235 — Information Disclosure in User Authentication

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

> ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.

### Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.

### References * [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)

Most recent entries from all

cnvd-2022-17984

EUVD-2026-28140

fkie_cve-2021-32767

GHSA-34fr-fhqr-7235 — Information Disclosure in User Authentication

gsd-2021-32767