GitHub Advisoryadvisory · Packagist
GHSA-38x7-cc6w-j27q TYPO3 Information Disclosure via Exception Handling/Logger
LOW
Official page ↗
- Aliases
- CVE-2024-55891
- Ecosystem
- Packagist
- Packages
- typo3/cms-install
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-532
- Reviewed
- 2025-01-14
Affected packages
• Packagist typo3/cms-install: >= 13.4.2, < 13.4.3 → fixed in 13.4.3
Description
Problem
It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect.
Solution
Update to TYPO3 versions 13.4.3 LTS that fixes the problem described.
Credits
Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.
References
• TYPO3-CORE-SA-2025-001
Related
Alias · CVE (1)
- CVE-2024-55891 TYPO3 is a free and open source Content Management Framework. vulnerability
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-38x7-cc6w-j27q web
- https://nvd.nist.gov/vuln/detail/CVE-2024-55891 advisory
- https://github.com/TYPO3-CMS/install/commit/baa8089b1baf5552fab213a5761081608b0afc51 web
- https://github.com/TYPO3-CMS/install package
- https://typo3.org/security/advisory/typo3-core-sa-2025-001 web