CVE-2025-59015

Medium CVSS: 6.3

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Vendor

Typo3

Product

Typo3

CWE

CWE-331

Yayın Tarihi

2025-09-09 09:15:40

Güncelleme

2025-09-10 13:42:59

Source Identifier

f4fb688c-4412-4426-b4b8-421ecf27b14a

KEV Date Added

Kategoriler

CWE-331 Typo3 MEDIUM Typo3 2025

Referanslar

https://typo3.org/security/advisory/typo3-core-sa-2025-019

Benzer Kayıtlar

Medium

CVE-2025-59021

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, crea…

High

CVE-2025-59022

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the T…

Medium

CVE-2026-0859

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious…

Medium

CVE-2025-59020

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO…

Medium

CVE-2025-59019

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.…

Medium

CVE-2025-59016

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0…