TYPO3 up to 12.4.36/13.4.17 Password Generation entropy

Summaryinfo

A vulnerability, which was classified as problematic, has been found in TYPO3 up to 12.4.36/13.4.17. This affects an unknown function of the component Password Generation. The manipulation leads to entropy. This vulnerability is uniquely identified as CVE-2025-59015. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in TYPO3 up to 12.4.36/13.4.17 and classified as problematic. This issue affects an unknown functionality of the component Password Generation. The manipulation with an unknown input leads to a entropy vulnerability. Using CWE to declare the problem leads to CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. Impacted is confidentiality, and integrity. The summary by CVE is:

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

The advisory is shared at typo3.org. The identification of this vulnerability is CVE-2025-59015 since 09/07/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 12.4.37 or 13.4.18 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-27230) and CERT Bund (WID-SEC-2025-2001). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• TYPO3 Core

Productinfo

Type

• Content Management System

Name

• TYPO3

Version

• 12.4.0
• 12.4.1
• 12.4.2
• 12.4.3
• 12.4.4
• 12.4.5
• 12.4.6
• 12.4.7
• 12.4.8
• 12.4.9
• 12.4.10
• 12.4.11
• 12.4.12
• 12.4.13
• 12.4.14
• 12.4.15
• 12.4.16
• 12.4.17
• 12.4.18
• 12.4.19
• 12.4.20
• 12.4.21
• 12.4.22
• 12.4.23
• 12.4.24
• 12.4.25
• 12.4.26
• 12.4.27
• 12.4.28
• 12.4.29
• 12.4.30
• 12.4.31
• 12.4.32
• 12.4.33
• 12.4.34
• 12.4.35
• 12.4.36
• 13.4.0
• 13.4.1
• 13.4.2
• 13.4.3
• 13.4.4
• 13.4.5
• 13.4.6
• 13.4.7
• 13.4.8
• 13.4.9
• 13.4.10
• 13.4.11
• 13.4.12
• 13.4.13
• 13.4.14
• 13.4.15
• 13.4.16
• 13.4.17

License

• open-source

Website

• Product: https://typo3.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion