GHSA-rxc9-f2x6-qh4w
TYPO3 Security Misconfiguration for Backend User Accounts
GHSA-rxc9-f2x6-qh4w is a high vulnerability (CVSS 7.5) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.23.
- Severity
- 7.5 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.7.23typo3/cms-core +3 more
Description
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following:
- account contains empty login credentials (username and/or password)
- account is incomplete and contains weak credentials (username and/or password)
Albeit the functionality provided by the TYPO3 core cannot be used either with empty usernames or empty passwords, it still can be a severe vulnerability to custom authentication service implementations.
This weakness cannot be directly exploited and requires interaction on purpose by some backend user having according privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 up to 8.7.23 | 8.7.23 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.4 | 9.5.4 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.23, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 11 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.7v8.7.8v8.7.9 | 8.7.23 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.4, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 8 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3 | 9.5.4 |
What each source reports
GitHub Advisories Score used
TYPO3 Security Misconfiguration for Backend User Accounts
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following:
- account contains empty login credentials (username and/or password)
- account is incomplete and contains weak credentials (username and/or password)
Albeit the functionality provided by the TYPO3 core cannot be used either with empty usernames or empty passwords, it still can be a severe vulnerability to custom authentication service implementations.
This weakness cannot be directly exploited and requires interaction on purpose by some backend user having according privileges.
- Record
GHSA-rxc9-f2x6-qh4w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
TYPO3 Security Misconfiguration for Backend User Accounts
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following:
- account contains empty login credentials (username and/or password)
- account is incomplete and contains weak credentials (username and/or password)
Albeit the functionality provided by the TYPO3 core cannot be used either with empty usernames or empty passwords, it still can be a severe vulnerability to custom authentication service implementations.
This weakness cannot be directly exploited and requires interaction on purpose by some backend user having according privileges.
- Record
GHSA-rxc9-f2x6-qh4w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/TYPO3-CMS/core/commit/1e0c7a60be0f324e77cdbc2dadef46458e191d47
typo3.org/security/advisory/typo3-core-sa-2019-002