CVE-2017-6370

CVE-2017-6370 is a medium-severity information disclosure vulnerability affecting TYPO3 versions up to 7.6.15. It allows remote attackers to sniff network traffic and obtain sensitive cleartext user credentials (userident and username) when the system sends an HTTP request to an index.php?loginProvider URI after an HTTPS Referer. The attack requires no user interaction or authentication and has a low impact on confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.