CVE-2025-59015
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-10
Assigner: TYPO3
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| typo3 | typo3 | From 12.0.0 (inc) to 12.4.37 (exc) |
| typo3 | typo3 | From 13.0.0 (inc) to 13.4.18 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-331 | The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in TYPO3 CMS affects the Password Generation component, where generated passwords start with a predictable three-character prefix (a lower-case letter, an upper-case letter, and a digit). This deterministic prefix reduces the overall entropy of the passwords, making them easier to guess through brute-force attacks. Passwords generated using random password rules are not affected. [1]
How can this vulnerability impact me? :
Because the passwords generated by TYPO3 CMS have a predictable prefix, attackers can perform brute-force attacks more efficiently, increasing the risk of unauthorized access to systems using these passwords. This weakens the security of accounts relying on the affected password generation method. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by examining generated passwords from the TYPO3 CMS Password Generation component. Specifically, check if passwords generated by the affected TYPO3 versions start with a deterministic three-character prefix consisting of a lower-case letter, an upper-case letter, and a digit. There are no specific commands provided to detect this vulnerability automatically, but you can script a check to identify passwords beginning with this predictable pattern. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update TYPO3 CMS to versions 12.4.37 LTS or 13.4.18 LTS, which fix the entropy issue in the Password Generation component. Additionally, follow TYPO3 Security Guide recommendations and subscribe to the typo3-announce mailing list for future updates. [1]