Insufficient Entropy in Password Generation
CVE-2025-59015

6.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 September 2025

What is CVE-2025-59015?

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Affected Version(s)

TYPO3 CMS 12.0.0 < 12.4.37

TYPO3 CMS 13.0.0 < 13.4.18

References

https://typo3.org/security/advisory/typo3-core-sa-2025-019
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mathias Brodala
Oliver Hader
.
CVE-2025-59015 : Password Generation Component Flaw in TYPO3 CMS by TYPO3