GHSA-wj85-rg5g-v8jm: 
PHP vulnerability analysis and mitigation

A security vulnerability was discovered in TYPO3 CMS versions 9.0.0 through 9.5.5, identified as GHSA-wj85-rg5g-v8jm. The vulnerability, disclosed on May 7, 2019, involves information disclosure in the User Authentication component of TYPO3's core system. This moderate severity issue affects the composer package typo3/cms-core (TYPO3 Advisory, GitHub Advisory).

The vulnerability stems from a logging configuration issue where login failures were being logged on the default stream with log level "warning" that included plain-text user credentials. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Moderate), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-256 (GitHub Advisory).

The vulnerability could lead to unauthorized disclosure of user credentials through system logs, as failed login attempts were being logged with plain-text credentials at the warning level, potentially exposing sensitive authentication information to unauthorized users (TYPO3 Advisory).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. The scope is unchanged, affecting only the confidentiality of the system with no impact on integrity or availability (GitHub Advisory).

The vulnerability was patched in TYPO3 version 9.5.6. The fix involved changing the log level for failed login attempts from "warning" to "debug", which needs to be explicitly enabled. Users are advised to upgrade to version 9.5.6 or later to address this security issue (TYPO3 Advisory, Core Commit).

The vulnerability was responsibly disclosed and addressed, with credit given to Helmut Hummel for reporting and fixing the issue (TYPO3 Advisory).