Medium
Security advisory
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-32767
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:49 UTC · Revision 1
Source evidence
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
osv:CVE-2021-32767
Complete source record
{
"id": "96dc78628747436d3bbe5a6946800881c8be1de957e5a9267e7ee0728de22968",
"url": "https://osv.dev/vulnerability/CVE-2021-32767",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-32767",
"summary": "TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.",
"evidence": "osv:CVE-2021-32767",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-32767",
"aliases": [
"BIT-typo3-2021-32767",
"CVE-2021-32767",
"GHSA-34fr-fhqr-7235"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/TYPO3/typo3",
"type": "GIT",
"events": [
{
"introduced": "41235ff8e38c6f3401df03ae8beddd62d662c525"
},
{
"last_affected": "c4ea833b64abbf8962eebd55becc5bb7f112351a"
},
{
"introduced": "c91b70e450c52d29ffb08115fffbb7832b15a330"
},
{
"last_affected": "fe16eeb92d49edc5e79041dd949bc68cf66dfdce"
},
{
"introduced": "6a5e2d4097ef0a0e3ea955af93cf83810d6fa234"
},
{
"last_affected": "5f11a2c94ea85f0401b0e00ec962368aa312ea1f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.5.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0"
},
{
"last_affected": "10.4.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"last_affected": "11.3.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v11.3.0",
"v10.4.17",
"v9.5.27",
"v10.4.16",
"v11.2.0",
"v10.4.15",
"v9.5.26",
"v10.4.14",
"v9.5.25",
"v11.1.0",
"v10.4.13",
"v11.0.0",
"v10.4.12",
"v10.4.11",
"v9.5.24",
"v10.4.10",
"v9.5.23",
"v10.4.9",
"v9.5.22",
"v10.4.8",
"v10.4.7",
"v9.5.21",
"v10.4.6",
"v9.5.20",
"v10.4.5",
"v10.4.4",
"v9.5.19",
"v10.4.3",
"v9.5.18",
"v9.5.17",
"v10.4.2",
"v10.4.1",
"v9.5.16",
"v10.4.0",
"v9.5.15",
"v10.3.0",
"v9.5.14",
"v9.5.13",
"v9.5.12",
"v10.2.0",
"v9.5.11",
"v9.5.10",
"v10.1.0",
"v9.5.9",
"v10.0.0",
"v9.5.8",
"v9.5.7",
"v9.5.6",
"v9.5.5",
"v9.5.4",
"v9.5.3",
"v9.5.2",
"v9.5.1",
"v9.5.0",
"v9.4.0",
"v9.3.0",
"v9.2.0",
"v9.1.0",
"v9.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32767.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/typo3/typo3",
"type": "GIT",
"events": [
{
"introduced": "41235ff8e38c6f3401df03ae8beddd62d662c525"
},
{
"last_affected": "c4ea833b64abbf8962eebd55becc5bb7f112351a"
},
{
"introduced": "c91b70e450c52d29ffb08115fffbb7832b15a330"
},
{
"last_affected": "fe16eeb92d49edc5e79041dd949bc68cf66dfdce"
},
{
"introduced": "6a5e2d4097ef0a0e3ea955af93cf83810d6fa234"
},
{
"last_affected": "5f11a2c94ea85f0401b0e00ec962368aa312ea1f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.5.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0"
},
{
"last_affected": "10.4.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"last_affected": "11.3.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v11.3.0",
"v10.4.17",
"v9.5.27",
"v10.4.16",
"v11.2.0",
"v10.4.15",
"v9.5.26",
"v10.4.14",
"v9.5.25",
"v11.1.0",
"v10.4.13",
"v11.0.0",
"v10.4.12",
"v10.4.11",
"v9.5.24",
"v10.4.10",
"v9.5.23",
"v10.4.9",
"v9.5.22",
"v10.4.8",
"v10.4.7",
"v9.5.21",
"v10.4.6",
"v9.5.20",
"v10.4.5",
"v10.4.4",
"v9.5.19",
"v10.4.3",
"v9.5.18",
"v9.5.17",
"v10.4.2",
"v10.4.1",
"v9.5.16",
"v10.4.0",
"v9.5.15",
"v10.3.0",
"v9.5.14",
"v9.5.13",
"v9.5.12",
"v10.2.0",
"v9.5.11",
"v9.5.10",
"v10.1.0",
"v9.5.9",
"v10.0.0",
"v9.5.8",
"v9.5.7",
"v9.5.6",
"v9.5.5",
"v9.5.4",
"v9.5.3",
"v9.5.2",
"v9.5.1",
"v9.5.0",
"v9.4.0",
"v9.3.0",
"v9.2.0",
"v9.1.0",
"v9.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32767.json"
}
}
],
"modified": "2026-10-24T10:50:24.401530075Z",
"provider": "osv",
"references": [
"https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235",
"https://typo3.org/security/advisory/typo3-core-sa-2021-012"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"
],
"vendor_product": "typo3:typo3",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.6.51"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.6.51"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.6.51"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.7.40"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.7.40"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.7.40"
},
{
"introduced": "9.0.0"
},
{
"last_affected": "9.5.27"
},
{
"introduced": "10.0.0"
},
{
"last_affected": "10.4.17"
},
{
"introduced": "11.0.0"
},
{
"last_affected": "11.3.0"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-32767",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442124,
"published_at": "2021-07-20T16:15:07.89+00:00"
}