PT-2024-40123 · Typo3 · Typo3

Published 2024-06-05 · Updated 2024-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: TYPO3 (affected versions not specified)

Description: The issue concerns an Authentication Bypass in the Salted Password system extension of TYPO3. This occurs when using hashing methods related by PHP class inheritance. Specifically, stored passwords using the blowfish hashing algorithm can be overridden by using MD5 as the default hashing algorithm, provided a valid username is known. The Portable PHP hashing algorithm (PHPass), which is used by default, is not vulnerable.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-6F9M-V7MP-7JJQ

Affected Products

Typo3

References · 4

• https://osv.dev/vulnerability/GHSA-6f9m-v7mp-7jjq · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-07-12-1.yaml · Note
• https://github.com/TYPO3/typo3 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2018-001 · Note