PT-2025-36691 · Typo3 Cms · Typo3/Cms

Mathias Brodala + 1 · Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-59015

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17

Description: A deterministic three-character prefix in the Password Generation component reduces entropy, potentially enabling attackers to expedite brute-force attacks.

Recommendations: Update TYPO3 CMS to a version later than 12.4.36. Update TYPO3 CMS to a version later than 13.4.17.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2025-59015

GHSA-P5JQ-5383-QVC7

Affected Products

Typo3/Cms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-59015 · Security Note
• https://osv.dev/vulnerability/GHSA-p5jq-5383-qvc7 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2025-019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59015 · Vendor Advisory
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70 · Note
• https://t.me/CVEtracker/32060 · Telegram Post
• https://twitter.com/CVEnew/status/1965343958445310184 · Twitter Post