Vulnerability advisory

GHSA-wj85-rg5g-v8jm

TYPO3 Information Disclosure in User Authentication

Published May 30, 2024Updated Dec 5, 2024OSV record ↗

Severity

Affected versions

Affected	Fixed in
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.