{"id":"CVE-2021-32767","published":"2021-07-20T16:00:11Z","modified":"2024-08-03T23:33:55Z","title":"Information Disclosure in User Authentication","vendor":"TYPO3","product":"TYPO3.CMS","tier":"tail","description":{"text":"TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00829,"percentile":0.57501,"provenance":"source"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"references":[{"url":"https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235","tags":["x_refsource_CONFIRM"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2021-012","tags":["x_refsource_MISC"]}],"priority":{"score":15.2,"factors":[{"name":"EPSS percentile","points":11.5},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"typo3","affectedVersions":[{"vendor":"TYPO3","product":"TYPO3.CMS","versions":[">= 9.0.0, < 9.5.28",">= 10.0.0, < 10.4.18",">= 11.0.0, < 11.3.1"]}],"affected":[{"ecosystem":"Packagist","package":"typo3/cms-core","vulnerableRanges":[">=7.0.0, <7.6.52",">=8.0.0, <8.7.41",">=9.0.0, <9.5.28",">=10.0.0, <10.4.18",">=11.0.0, <11.3.1"],"patched":["7.6.52","8.7.41","9.5.28","10.4.18","11.3.1"],"from":["GHSA-34fr-fhqr-7235"],"provenance":"source"},{"ecosystem":"Packagist","package":"typo3/cms","vulnerableRanges":[">=10.0.0, <10.4.18",">=11.0.0, <11.3.1",">=9.0.0, <9.5.28"],"patched":["10.4.18","11.3.1","9.5.28"],"from":["GHSA-34fr-fhqr-7235"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1435","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-typo3-cve-2021-32767","children":[{"from":"CVE-2021-32767","to":"CVE-2022-36105","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php"],"commits":["https://github.com/TYPO3/typo3/commit/0b4950163b8919451964133febc65bcdfcec721c","https://github.com/TYPO3/typo3/commit/f8b83ce15d4ea275a5a5e564e5d324242f7937b6","https://github.com/TYPO3/typo3/commit/f0fc9c4cd7c38207c30dd158de53ee5d9d6f41a2"],"basis":"shared function","functions":["checkAuthentication"]}]},{"from":"CVE-2021-32767","to":"CVE-2023-47127","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["typo3/sysext/core/Classes/Session/UserSessionManager.php"],"commits":["https://github.com/TYPO3/typo3/commit/0b4950163b8919451964133febc65bcdfcec721c","https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2021-21339","published":"2021-03-23","fixed":"11.1.1","kev":false,"link":{"from":"CVE-2021-21339","to":"CVE-2021-32767","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:typo3/cms-core","fromFixed":"8.7.40","toFixed":"8.7.41","daysApart":119},{"kind":"version-step","provenance":"source","package":"Packagist:typo3/cms-core","fromFixed":"7.6.51","toFixed":"7.6.52","daysApart":119}]}},{"cve":"CVE-2021-32667","published":"2021-07-20","fixed":"11.3.1","kev":false},{"cve":"CVE-2021-32668","published":"2021-07-20","fixed":"11.3.1","kev":false},{"cve":"CVE-2021-32669","published":"2021-07-20","fixed":"11.3.1","kev":false},{"cve":"CVE-2021-32767","published":"2021-07-20","fixed":"11.3.1","kev":false},{"cve":"CVE-2021-32768","published":"2021-08-10","fixed":"11.3.2","kev":false,"link":{"from":"CVE-2021-32767","to":"CVE-2021-32768","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:typo3/cms-core","fromFixed":"7.6.52","toFixed":"7.6.53","daysApart":21}]}},{"cve":"CVE-2021-41113","published":"2021-10-05","fixed":"11.5.0","kev":false},{"cve":"CVE-2021-41114","published":"2021-10-05","fixed":"11.5.0","kev":false}],"package":"Packagist:typo3/cms-core"}}