← Back

CVE-2025-59015

nvd nist
Published: Sep 9, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary)

Description

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Affected (2)

Products: Typo3: Typo3
Typo3
1 product
Typo3
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Typo3
Typo3
From 12.0.0 to 12.4.37
Typo3
From 13.0.0 to 13.4.18

Related CWEs

CWE-331
Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (1)

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a
Vendor Advisory

Timeline

No history available yet.