GHSA-p5jq-5383-qvc7

ghsaUSosv

TYPO3 CMS uses insufficient entropy when generating passwords

view advisory published 2025-09-09Licence: CC-BY-4.0

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-59015US	medium6.5	0.19% (8th)	—	2025-09-09
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out…

references

External citations — patches, advisories, analysis.

https://github.com/TYPO3-CMS/corePACKAGE
https://github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-59015ADVISORY
https://typo3.org/security/advisory/typo3-core-sa-2025-019WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan