{"id":"CVE-2009-0255","aliases":["DSA-1711-1","EUVD-2009-0263","GHSA-7x3q-vm79-8fcc"],"status":"published","title":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0...","description":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09442,"percentile":0.95456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-330"],"published":"2009-01-22T23:00:00Z","modified":"2026-06-16T23:04:35Z","exploits":[{"source":"metasploit","id":"auxiliary/admin/http/typo3_sa_2009_001","title":"TYPO3 sa-2009-001 Weak Encryption Key File Disclosure","type":"auxiliary","date":"2009-01-20","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/typo3_sa_2009_001"}],"affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"typo3-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2+debian-7"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"typo3","product":"typo3"}],"references":[{"url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/33617","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1711","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48132","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/33376","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/33679","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0255"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001"},{"url":"https://github.com/advisories/GHSA-7x3q-vm79-8fcc"}],"sources":{"cve":[{"id":"CVE-2009-0255","description":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.","status":"published","published":"2009-01-22T23:00:00Z","modified":"2024-08-07T04:24:18.421Z","updated_at":"2026-11-02T14:33:25.896677Z"}],"euvd":[{"id":"EUVD-2009-0263","description":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.","status":"published","published":"2009-01-22T23:00:00Z","modified":"2024-08-07T04:24:18Z","updated_at":"2026-11-03T01:39:26.585153Z"}],"ghsa":[{"id":"GHSA-7x3q-vm79-8fcc","title":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0...","description":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.","status":"published","published":"2022-05-02T03:13:51Z","modified":"2026-03-21T05:36:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:06:45.356317Z"}],"nvd":[{"id":"CVE-2009-0255","description":"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.","status":"published","published":"2009-01-22T23:30:00.203Z","modified":"2026-06-16T23:04:35.89Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:01:33.417327Z"}],"osv":[{"id":"DSA-1711-1","title":"typo3-src - remote code execution","status":"published","published":"2009-01-26T00:00:00Z","modified":"2026-03-09T01:17:53.850288Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}