GitHub Advisoryadvisory · Packagist

GHSA-h7wf-jg4f-x2wc TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash

CRITICAL Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2014-3945
Ecosystem
Packagist
Packages
typo3/cms
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-287
Reviewed
2025-04-14

Affected packages

• Packagist typo3/cms: < 6.2.0 → fixed in 6.2.0

Description

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.

Related

Alias · CVE (1)

  • CVE-2014-3945 The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References