GHSA-38x7-cc6w-j27q
TYPO3 Information Disclosure via Exception Handling/Logger
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | typo3/cms-install | >= 13.4.2, < 13.4.3 | 13.4.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Problem
It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect.
### Solution
Update to TYPO3 versions 13.4.3 LTS that fixes the problem described.
### Credits
Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.
### References
* [TYPO3-CORE-SA-2025-001](https://typo3.org/security/advisory/typo3-core-sa-2025-001)
References
External links from the advisory. They lead to third-party sites.