TYPO3 Core

When you log into the install tool, the password is transmitted plaintext "as is" to the server and there it gets md5 hashed and compared to the password stored in localconf.php.

It would be better to use a challenge/response like for the BE-Login

The only remaining weakness is setting the Install Tool Password right out of the Install Tool. Cause here it is again transmitted in plaintext. An asymmetric encryption could solve this problem (Not part of this bug/patch).

For the problem of plain-text Install Tool Login a patch is attached (against rev. 6310)

(issue imported from #M12430)