CVE-2021-32767

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327686.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, CVE-2021-327697.5Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in version CVE-2021-32777.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic CVE-2021-327718.1Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflo CVE-2021-327728.8Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters CVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluate CVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no pr CVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valu CVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Win CVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when e CVE-2021-327787.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’