CVE-2024-55891— Information Disclosure via Exception Handling/Logger in TYPO3
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-55891
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure via Exception Handling/Logger in TYPO3
Source: NVD (National Vulnerability Database)
Vulnerability Description
TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过日志文件的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
TYPO3 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TYPO3是瑞士TYPO3协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3存在日志信息泄露漏洞，该漏洞源于用于密码的密码哈希机制不正确，安装工具密码将以明文形式记录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-55891
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-55891
请登录查看更多情报信息。
Same Patch Batch · TYPO3 · 2025-01-14 · 10 CVEs total
| CVE-2024-55924 | 8.0 HIGH | Cross-Site Request Forgery in Scheduler Module in TYPO3 |
| CVE-2024-55921 | 7.5 HIGH | Cross-Site Request Forgery in Extension Manager Module in TYPO3 |
| CVE-2024-55922 | 5.4 MEDIUM | Cross-Site Request Forgery in Form Framework Module in TYPO3 |
| CVE-2024-55892 | 4.8 MEDIUM | Potential Open Redirect via Parsing Differences in TYPO3 |
| CVE-2024-55923 | 4.3 MEDIUM | Cross-Site Request Forgery in Indexed Search Module in TYPO3 |
| CVE-2024-55894 | 4.3 MEDIUM | TYPO3 Cross-Site Request Forgery in Backend User Module |
| CVE-2024-55945 | 4.3 MEDIUM | Cross-Site Request Forgery in DB Check Module in TYPO3 |
| CVE-2024-55893 | 4.3 MEDIUM | TYPO3 Cross-Site Request Forgery in Log Module |
| CVE-2024-55920 | 4.3 MEDIUM | Cross-Site Request Forgery in Dashboard Module in TYPO3 |
IV. Related Vulnerabilities
Same product: typo3
- CVE-2025-47941
TYPO3 Has Broken Authentication in Backend MFA - CVE-2025-47940
TYPO3 CMS Vulnerable to Privilege Escalation to System Maint - CVE-2025-47939
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abs - CVE-2025-47938
TYPO3 Vulnerable to Unverified Password Change for Backend U - CVE-2025-47937
TYPO3 Vulnerable to Information Disclosure via DBAL Restrict
Same vendor: TYPO3
- CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module - CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mf - CVE-2026-4202
Broken Access Control in extension "Redirect Tab" - CVE-2026-1323
Insecure Deserialization in extension "Mailqueue" (mailqueue - CVE-2026-0895
Insecure Deserialization in extension "Mailqueue" (mailqueue
Same weakness: CWE-532
- CVE-2026-42282
n8n-MCP: Sensitive MCP tool-call arguments logged on authent - CVE-2026-41495
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Req - CVE-2026-41004
VMware Spring Cloud Config 日志信息泄露漏洞 - CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken - CVE-2026-7824
PaperCut Hive (Ricoh): Plain text password in logs
V. Comments for CVE-2024-55891
No comments yet