TYPO3 Information Disclosure in User Authentication · GHSA-wj85-rg5g-v8jm · GitHub Advisory Database · GitHub

TYPO3 Information Disclosure in User Authentication

Moderate severity GitHub Reviewed Published May 30, 2024 to the GitHub Advisory Database • Updated May 30, 2024

Package

typo3/cms-core (Composer)

Affected versions

>= 9.0.0, < 9.5.6

Patched versions

9.5.6

Description

It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.

References

Published to the GitHub Advisory Database May 30, 2024

Reviewed May 30, 2024

Last updated May 30, 2024

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N