GitHub Advisoryadvisory · Packagist

GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS

MEDIUM Published 2024-06-05 Modified 2024-06-05 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287
Reviewed
2024-06-05

Affected packages

• Packagist typo3/cms: >= 6.2.0, < 6.2.20 → fixed in 6.2.20 • Packagist typo3/cms: >= 7.6.0, < 7.6.5 → fixed in 7.6.5 • Packagist typo3/cms: >= 8.0.0, < 8.0.1 → fixed in 8.0.1

Description

The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database. Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References