Typo3 Information Disclosure in User Authentication

2024-06-0517:09:30

Google

osv.dev

typo3

information disclosure

user authentication

plain-text

user credentials

security

7.3 High

AI Score

Confidence

Low

JSON

It has been discovered that login failures have been logged on the default stream with log level “warning” including plain-text user credentials.

CPENameOperatorVersion
typo3/cmseq9.0.0
typo3/cmseq9.3.0
typo3/cmseq9.3.1
typo3/cmseq9.4.0
typo3/cmseq9.5.2
typo3/cmseq9.5.4
typo3/cmseq9.3.3
typo3/cmseq9.5.3
typo3/cmseq9.2.0
typo3/cmseq9.5.5

Name	Operator	Version
typo3/cms	eq	9.0.0
typo3/cms	eq	9.3.0
typo3/cms	eq	9.3.1
typo3/cms	eq	9.4.0
typo3/cms	eq	9.5.2
typo3/cms	eq	9.5.4
typo3/cms	eq	9.3.3
typo3/cms	eq	9.5.3
typo3/cms	eq	9.2.0
typo3/cms	eq	9.5.5

Rows per page:

1-10 of 151

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-05-07-5.yaml

github.com/TYPO3/typo3

typo3.org/security/advisory/typo3-core-sa-2019-010

7.3 High

AI Score

Confidence

Low

JSON