PT-2025-22140 · Typo3 · Typo3

Published 2025-05-20 · Updated 2025-05-20 · CVE-2025-47938

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.50 ELTS TYPO3 versions 10.0.0 through 10.4.49 ELTS TYPO3 versions 11.0.0 through 11.5.43 ELTS TYPO3 versions 12.0.0 through 12.4.30 LTS TYPO3 versions 13.0.0 through 13.4.11 LTS

Description: The backend user management interface in TYPO3 allows password changes without requiring the current password, potentially lowering protection against unauthorized access in scenarios where an admin session is hijacked or left unattended. This behavior enables password changes without additional authentication when an administrator updates their own account or modifies other user accounts via the admin interface.

Recommendations: Update to TYPO3 version 9.5.51 ELTS Update to TYPO3 version 10.4.50 ELTS Update to TYPO3 version 11.5.44 ELTS Update to TYPO3 version 12.4.31 LTS Update to TYPO3 version 13.4.12 LTS

Exploit

Fix

Weakness Enumeration

CWE-620

Related Identifiers

BDU:2025-06003

CVE-2025-47938

GHSA-3JRG-97F3-RQH9

Affected Products

Typo3

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47938.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-3jrg-97f3-rqh9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3jrg-97f3-rqh9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06003 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2025-013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47938 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47938 · Vendor Advisory
• https://github.com/TYPO3-CMS/core/commit/b9a8bcb614ecdd42aa27e1c430c6213d6b6b20b3 · Note
• https://github.com/TYPO3-CMS/setup/commit/60572dd050d8d861921889a19599bfe045fed5fd · Note
• https://twitter.com/CVEnew/status/1924831542250967325 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1924843534747586894 · Twitter Post