CVE-2025-59015: TYPO3 CMS Insufficient Entropy in Password Generation
Summary
CVE-2025-59015: TYPO3 CMS uses insufficient entropy when generating passwords. Affects typo3/cms-core across 2 version ranges.
>= 12.0.0, < 12.4.37
>= 13.0.0, < 13.4.18
Fixed in 12.4.37 or 13.4.18, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust framework for developers and users, enabling the creation of complex web applications with ease. However, certain versions of TYPO3 CMS have been found to have a vulnerability in their password generation component, which can compromise the security of user accounts.
Vulnerability Detail
The vulnerability arises from a deterministic three-character prefix used in the Password Generation component of TYPO3 CMS versions 12.0.0 to 12.4.36 and 13.0.0 to 13.4.17. This prefix reduces the entropy of generated passwords, making them more predictable and allowing attackers to perform brute-force attacks more efficiently. The issue is classified under CWE-331, indicating insufficient entropy in cryptographic operations, which can lead to unauthorized access and data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.4.3712.4.37composer require typo3/cms-core:12.4.37 -
>= 13.0.0, < 13.4.1813.4.18composer require typo3/cms-core:13.4.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as enforcing stronger password policies or utilizing multi-factor authentication (MFA) to mitigate the risk of brute-force attacks until the package is updated.
Conclusion
In summary, CVE-2025-59015 highlights a significant vulnerability in TYPO3 CMS related to password generation. It is crucial for users of affected versions to update their installations to the latest patched versions to ensure the security of their applications and protect against potential brute-force attacks.
See every vulnerability recorded for typo3/cms-core →
FAQ
CVE-2025-59015 is a vulnerability in TYPO3 CMS that involves insufficient entropy in the password generation process, making passwords easier to guess.
The affected versions are TYPO3 CMS 12.0.0 to 12.4.36 and 13.0.0 to 13.4.17.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Update TYPO3 CMS to the latest patched versions and consider implementing stronger password policies and multi-factor authentication.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
