CVE-2025-59015: TYPO3 CMS uses insufficient entropy when generating passwords
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
Other sources
TYPO3 CMS uses insufficient entropy when generating passwords
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.18 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.37
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59015?
CVE-2025-59015 is considered a high-severity vulnerability due to its potential to significantly reduce password entropy.
How do I fix CVE-2025-59015?
To fix CVE-2025-59015, upgrade to TYPO3 CMS versions 12.4.37 or 13.4.18 or later.
What versions of TYPO3 CMS are affected by CVE-2025-59015?
CVE-2025-59015 affects TYPO3 CMS versions 12.0.0 to 12.4.36 and 13.0.0 to 13.4.17.
What kind of attacks can CVE-2025-59015 facilitate?
CVE-2025-59015 can facilitate brute-force attacks due to the deterministic prefix in password generation.
Is there a workaround for CVE-2025-59015?
No official workaround is recommended; upgrading to a patched version is the best mitigation.