Vulnerability advisory

GHSA-p5jq-5383-qvc7

TYPO3 CMS uses insufficient entropy when generating passwords

Published Sep 9, 2025Updated Sep 10, 2025OSV record ↗

Also known as CVE-2025-59015

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`12.0.0` to before 12.4.37	`12.4.37`Advisories →
Also listed as affected (44) `v12.0.0` `v12.1.0` `v12.1.1` `v12.1.2` `v12.1.3` `v12.2.0` `v12.3.0` `v12.4.0` `v12.4.1` `v12.4.10` `v12.4.11` `v12.4.12` `v12.4.13` `v12.4.14` `v12.4.15` `v12.4.16` `v12.4.17` `v12.4.18` `v12.4.19` `v12.4.2` `v12.4.20` `v12.4.21` `v12.4.22` `v12.4.23` `v12.4.24` `v12.4.25` `v12.4.26` `v12.4.27` `v12.4.28` `v12.4.29` `v12.4.3` `v12.4.30` `v12.4.31` `v12.4.32` `v12.4.33` `v12.4.34` `v12.4.35` `v12.4.36` `v12.4.4` `v12.4.5` `v12.4.6` `v12.4.7` `v12.4.8` `v12.4.9`
`13.0.0` to before 13.4.18	`13.4.18`Advisories →
Also listed as affected (26) `v13.0.0` `v13.0.1` `v13.1.0` `v13.1.1` `v13.2.0` `v13.2.1` `v13.3.0` `v13.3.1` `v13.4.0` `v13.4.1` `v13.4.10` `v13.4.11` `v13.4.12` `v13.4.13` `v13.4.14` `v13.4.15` `v13.4.16` `v13.4.17` `v13.4.2` `v13.4.3` `v13.4.4` `v13.4.5` `v13.4.6` `v13.4.7` `v13.4.8` `v13.4.9`

Description

A deterministic three‐character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‐force attacks more quickly.

GHSA-p5jq-5383-qvc7

Affected versions

typo3/cms-core Packagist

Description

References