Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-32767

Date: July 20, 2021

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

Language: PHP

Severity Score

Related Resources (10)

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235
https://nvd.nist.gov/vuln/detail/CVE-2021-32767
https://github.com/TYPO3/typo3/commit/0b4950163b8919451964133febc65bcdfcec721c
https://typo3.org/security/advisory/typo3-core-sa-2021-013
https://typo3.org/security/advisory/typo3-core-sa-2021-012
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-32767.yaml
https://github.com/TYPO3/typo3
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-32767.yaml
https://github.com/TYPO3/typo3/security/advisories/GHSA-34fr-fhqr-7235
https://www.mend.io/vulnerability-database/CVE-2021-32767

Severity Score

Weakness Type (CWE)

Insertion of Sensitive Information into Log File

CWE-532

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us