Vulnerability advisory

GHSA-m96r-7vqm-j95g

Typo3 Information Disclosure in User Authentication

Published Jun 5, 2024Updated Dec 2, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

Affected	Fixed in
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.