CVE-2014-3945: TYPO3 CMS Authentication Bypass via Password Hash Knowledge
Summary
CVE-2014-3945: TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash. Affects typo3/cms versions < 6.2.0. Fixed in 6.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust framework for developers and users, enabling the creation of complex web applications with ease. TYPO3's authentication component is crucial for securing access to the backend, ensuring that only authorized users can manage content and settings. However, a vulnerability in versions prior to 6.2 allows attackers to bypass authentication if they possess knowledge of a user's password hash.
Vulnerability Detail
The vulnerability arises from the way TYPO3 handles password hashing when salting is disabled. In versions before 6.2, if an attacker knows a valid password hash, they can gain unauthorized access to the backend without needing the cleartext password. This flaw poses a significant risk, as it allows remote attackers to exploit this weakness and potentially compromise the entire system.
How To Fix
Minimum fixed version
6.2.0
This is the first release that contains the fix.
composer require typo3/cms:6.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to enable salting for password hashing if it is not already enabled. This can help mitigate the risk of unauthorized access until the system can be updated to a patched version.
Conclusion
In summary, CVE-2014-3945 is a critical vulnerability affecting TYPO3 versions prior to 6.2, allowing authentication bypass through knowledge of password hashes. It is crucial to update to the latest version to protect against this security risk. Additionally, using tools like Vulert can help monitor and alert for vulnerabilities in your open-source software.
See every vulnerability recorded for typo3/cms →
FAQ
CVE-2014-3945 is a vulnerability in TYPO3 that allows attackers to bypass authentication by leveraging knowledge of a password hash.
All versions of TYPO3 prior to 6.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, ensure that salting for password hashing is enabled as a temporary measure to reduce risk.
If exploited, this vulnerability can allow unauthorized users to gain access to the TYPO3 backend, potentially leading to data breaches or system compromise.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
