GHSA-x4rj-f7m6-42c3
TYPO3 CMS Authentication Bypass vulnerability
GHSA-x4rj-f7m6-42c3 is a high vulnerability (CVSS 7.5) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.17.
- Severity
- 7.5 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.7.17typo3/cms-core +4 more
Description
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 up to 8.7.17 | 8.7.17 |
typo3/cms-corePackagist | 9.0.0 up to 9.3.2 | 9.3.2 |
typo3/cms-corePackagist | 7.0.0 up to 7.6.30 | 7.6.30 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.17, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 5 moreShow lessv8.7.15v8.7.16v8.7.7v8.7.8v8.7.9 | 8.7.17 |
typo3/cms-corePackagist | 9.0.0 up to 9.3.2, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0v9.3.1 | 9.3.2 |
What each source reports
GitHub Advisories Score used
TYPO3 CMS Authentication Bypass vulnerability
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
- Record
GHSA-x4rj-f7m6-42c3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
TYPO3 CMS Authentication Bypass vulnerability
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
- Record
GHSA-x4rj-f7m6-42c3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.