CVE-2024-55891: TYPO3 Information Disclosure via Exception Handling/Logger
Problem It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect.
Solution Update to TYPO3 versions 13.4.3 LTS that fixes the problem described.
Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.
References TYPO3-CORE-SA-2025-001
Other sources
TYPO3 Information Disclosure via Exception Handling/Logger
— Packagist
TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-installto a version that resolves this vulnerability.Fixed in 13.4.3 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 13.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55891?
CVE-2024-55891 has been classified with a high severity due to the potential exposure of sensitive password information in plaintext.
How do I fix CVE-2024-55891?
To fix CVE-2024-55891, update your TYPO3 installation to version 13.4.3 LTS or later.
What types of applications are affected by CVE-2024-55891?
CVE-2024-55891 affects installations of the TYPO3 CMS that use the install tool with incorrect password hashing mechanisms.
What are the potential impacts of CVE-2024-55891?
The potential impacts of CVE-2024-55891 include unauthorized access to sensitive information if plaintext passwords are logged.
Who discovered CVE-2024-55891?
CVE-2024-55891 was discovered and reported by contributors to the TYPO3 project.