PT-2025-3142 · Typo3 · Typo3

Oliver Hader · Published 2025-01-14 · Updated 2025-01-15 · CVE-2024-55891

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 13.4.3 ELTS

Description A problem has been discovered where the install tool password is logged as plaintext if the password hashing mechanism used for the password was incorrect. There are no known workarounds for this issue. Users are advised to update to a fixed version.

Recommendations Update to TYPO3 version 13.4.3 ELTS, which fixes the problem described. As a temporary workaround, consider restricting access to the install tool until the update is applied.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-55891

GHSA-38X7-CC6W-J27Q

Affected Products

Typo3

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55891.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-38x7-cc6w-j27q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55891 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2025-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55891 · Security Note
• https://osv.dev/vulnerability/GHSA-38x7-cc6w-j27q · Vendor Advisory
• https://github.com/TYPO3-CMS/install · Note
• https://github.com/TYPO3-CMS/install/commit/baa8089b1baf5552fab213a5761081608b0afc51 · Note
• https://twitter.com/CVEnew/status/1879290712614728054 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879364612476297458 · Twitter Post
• https://t.me/cvedetector/15369 · Telegram Post