CVE-2024-55891: 
PHP vulnerability analysis and mitigation

TYPO3, a free and open source Content Management Framework, disclosed a vulnerability (CVE-2024-55891) on January 14, 2025. The vulnerability involves the install tool password being logged in plaintext when the password hashing mechanism was incorrect. This security issue affects TYPO3 version 13.4.2 and earlier versions (TYPO3 Advisory, GitHub Advisory).

The vulnerability is classified as a low-severity information disclosure issue with a CVSS v3.1 base score of 3.1. The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction needed, unchanged scope, and low confidentiality impact with no integrity or availability impact. The vulnerability is categorized as CWE-532 (Insertion of Sensitive Information into Log File) (GitHub Advisory).

The vulnerability could lead to the exposure of plaintext passwords in log files when the password hashing mechanism fails, potentially compromising user credentials. However, the impact is considered low due to the high attack complexity and the requirement for low-level privileges to exploit (TYPO3 Advisory).

Users are advised to update to TYPO3 version 13.4.3 LTS which contains the fix for this vulnerability. No alternative workarounds are available (TYPO3 Advisory).