Typo3 Information Disclosure in User Authentication

2024-06-0517:09:30

GitHub Advisory Database

github.com

typo3

information disclosure

user authentication

plain-text

user credentials

security

7.3 High

AI Score

Confidence

Low

It has been discovered that login failures have been logged on the default stream with log level “warning” including plain-text user credentials.

Affected configurations

Vulners

Node

typo3cms_poll_system_extensionRange<9.5.6

CPENameOperatorVersion
typo3/cmslt9.5.6

CPE	Name	Operator	Version
	typo3/cms	lt	9.5.6

github.com/advisories/GHSA-m96r-7vqm-j95g

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-05-07-5.yaml

typo3.org/security/advisory/typo3-core-sa-2019-010

7.3 High

AI Score

Confidence

Low