CVE-2021-32767
published 2021-07-20CVE-2021-32767: TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.83%
52.9th percentile
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 10.0.0 < 10.4.18 | 10.4.18 |
| typo3 | cms | >= 11.0.0 < 11.3.1 | 11.3.1 |
| typo3 | cms | >= 9.0.0 < 9.5.28 | 9.5.28 |
| typo3 | cms-core | >= 10.0.0 < 10.4.18 | 10.4.18 |
| typo3 | cms-core | >= 11.0.0 < 11.3.1 | 11.3.1 |
| typo3 | cms-core | >= 7.0.0 < 7.6.52 | 7.6.52 |
| typo3 | cms-core | >= 8.0.0 < 8.7.41 | 8.7.41 |
| typo3 | cms-core | >= 9.0.0 < 9.5.28 | 9.5.28 |
| typo3 | typo3 | 10.0.0 – 10.4.17 | — |
| typo3 | typo3 | 11.0.0 – 11.3.0 | — |
| typo3 | typo3 | 7.0.0 – 7.6.51 | — |
| typo3 | typo3 | 8.0.0 – 8.7.40 | — |
| typo3 | typo3 | 9.0.0 – 9.5.27 | — |
| typo3 | typo3.cms | — | — |
| typo3 | typo3.cms | — | — |
| typo3 | typo3.cms | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Information Disclosure in User Authentication
ghsa·2021-07-26
CVE-2021-32767 [MEDIUM] CWE-532 Information Disclosure in User Authentication
Information Disclosure in User Authentication
> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)
### Problem
It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.
### Solution
Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
### Credits
Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.
### References
* [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
OSV
Information Disclosure in User Authentication
osv·2021-07-26
CVE-2021-32767 [MEDIUM] Information Disclosure in User Authentication
Information Disclosure in User Authentication
> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)
### Problem
It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.
### Solution
Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
### Credits
Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.
### References
* [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-07-20
Published