CVE-2021-32767: Information Disclosure in User Authentication
> ### Meta > CVSS: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C (4.9)
Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the default configuration.
Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.
References TYPO3-CORE-SA-2021-012
Other sources
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
TYPO3-CORE-SA-2021-012: Information Disclosure in User Authentication
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-32767?
CVE-2021-32767 is a vulnerability in TYPO3 that allows user credentials to be logged as plain-text when log level debug is explicitly used.
Which versions of TYPO3 are affected by CVE-2021-32767?
Versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 of TYPO3 are affected by CVE-2021-32767.
What is the severity of CVE-2021-32767?
CVE-2021-32767 has a severity score of 6.5 (medium).
How can I fix CVE-2021-32767?
To fix CVE-2021-32767, ensure your TYPO3 installation is not using log level debug or update to a version that has the patch for this vulnerability.
Where can I find more information about CVE-2021-32767?
You can find more information about CVE-2021-32767 on the TYPO3 security advisory page (https://typo3.org/security/advisory/typo3-core-sa-2021-012) and the GitHub advisory page (https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235).