CVE-2021-32767: Information Disclosure in User Authentication

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-20 · updated 2026-06-17
Weakness: CWE-532

Description

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

Affected products

typo3: from 7.0.0 through 7.6.51; from 8.0.0 through 8.7.40; from 9.0.0 through 9.5.27; from 10.0.0 through 10.4.17; from 11.0.0 through 11.3.0

References

https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235
https://typo3.org/security/advisory/typo3-core-sa-2021-012
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235
https://typo3.org/security/advisory/typo3-core-sa-2021-012

Get alerted when CVE-2021-32767 or the next vulnerability affects your stack