TYPO3 Core

This is not a direct security problem.

We discussed this with the security team and came to the following conclusion:
It would be best, if we do not store the password at all. To achive that, we should remove the check for saved user password to display the "TER upload" tab in new em. We should then remove the 'save username + password' functionality from settings tab. Furthermore, we should add an update wizard that cycles through all be_users and removes the credentials.

This could be done for 4.7.

Patch set 1 for branch master_new has been pushed to the review server.
It is available at http://review.typo3.org/13325

This low priority issue can be handled publicly.

Solution: Introduce a new report, that checks if the password has been saved in uc, for master: additionally introduce an upgrade wizard that removes the password from all users if there are any

The gerrit code review messages are false. So set back to new.

Patch set 1 for branch TYPO3_4-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/25689

Helmut Hummel Nov 26 13:49

Patch Set 1:

If someone likes to pick this up, great.

The security team will not push this to be fixed any more and since it is not an issue any more with EM starting from 6.0 I'm fine to just abandon this.