PT-2024-40235 · Typo3 · Typo3

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 (affected versions not specified)

Description: The issue arises when creating new backend user accounts in the TYPO3 backend, potentially leading to database records with insecure or empty credentials being persisted. This occurs when the user account type is changed, causing the backend form to reload and reflect new configuration possibilities, but also persisting the current state. This can result in accounts with empty login credentials or incomplete and weak credentials. Although the TYPO3 core functionality cannot be used with empty usernames or passwords, custom authentication service implementations may still be severely vulnerable. This weakness requires intentional interaction by a backend user with appropriate privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-C5MJ-39CF-3PP5

Affected Products

Typo3

References · 6

• https://osv.dev/vulnerability/GHSA-c5mj-39cf-3pp5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-2.yaml · Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/e4d0cff40a4f8f597e52c20fff529e206bb62703 · Note
• https://github.com/TYPO3/typo3/commit/b3608d14e1915030cde272000a247cb6d5f982b8 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-002 · Note