PT-2024-40463 · Typo3 · Typo3

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 (affected versions not specified)

Description The issue arises when creating new backend user accounts in the TYPO3 backend, potentially leading to database records with insecure or empty credentials being persisted. This occurs when the user account type is changed, causing the backend form to reload and reflect new configuration possibilities, but also persisting the current state. This can result in accounts with empty login credentials or incomplete and weak credentials. Although the TYPO3 core functionality cannot be used with empty usernames or passwords, custom authentication service implementations may still be severely vulnerable. The weakness requires intentional interaction by a backend user with appropriate privileges and cannot be directly exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-RXC9-F2X6-QH4W

Affected Products

Typo3

References · 6

• https://osv.dev/vulnerability/GHSA-rxc9-f2x6-qh4w · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-2.yaml · Note
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/88c53ed5006c830d8da3c3a5f3c1b81839f1efb4 · Note
• https://github.com/TYPO3-CMS/core/commit/1e0c7a60be0f324e77cdbc2dadef46458e191d47 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-002 · Note