← Back

CVE-2021-32767

nvd nist
Published: Jul 20, 2021Modified: Nov 21, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

Affected (5)

Products: Typo3: Typo3
Typo3
1 product
Typo3
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Typo3
Typo3
From 10.0.0 to 10.4.17
Typo3
From 11.0.0 to 11.3.0
Typo3
From 7.0.0 to 7.6.51
Typo3
From 8.0.0 to 8.7.40
Typo3
From 9.0.0 to 9.5.27

Related CWEs

CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (4)

Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.