TYPO3 Security Misconfiguration for Backend User Accounts
Summary
GHSA-c5mj-39cf-3pp5: TYPO3 Security Misconfiguration for Backend User Accounts. Affects typo3/cms across 2 version ranges.
>= 8.0.0, < 8.7.23
>= 9.0.0, < 9.5.4
Fixed in 8.7.23 or 9.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that allows users to create and manage websites. It provides a backend interface for administrators to configure and control various aspects of the CMS. However, a security misconfiguration vulnerability exists in TYPO3 versions 8.0.0 to 8.7.23 and 9.0.0 to 9.5.4. This vulnerability can result in the persistence of insecure or empty credentials for backend user accounts, posing a risk to custom authentication service implementations.
Vulnerability Detail
When creating new backend user accounts in TYPO3, insecure or empty credentials may be stored in the database. Changing the type of user account triggers a reload of the backend form, which can lead to the persistence of the current state. This means that backend user accounts may contain empty or weak credentials, such as empty usernames or passwords. While the TYPO3 core does not allow the use of empty usernames or passwords, this vulnerability can still be exploited by custom authentication service implementations. It is important to note that this vulnerability requires interaction by a backend user with appropriate privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.238.7.23composer require typo3/cms:8.7.23 -
>= 9.0.0, < 9.5.49.5.4composer require typo3/cms:9.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by regularly reviewing and updating backend user account credentials manually.
Conclusion
The security misconfiguration vulnerability in TYPO3 versions 8.0.0 to 8.7.23 and 9.0.0 to 9.5.4 can result in the persistence of insecure or empty credentials for backend user accounts. This vulnerability requires interaction by a backend user with appropriate privileges. It is recommended to update TYPO3 to the fixed versions and review/update existing backend user account credentials to mitigate the risk.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
A backend user account is an account used to access the administrative interface of TYPO3 and manage the CMS.
The vulnerability occurs when creating new backend user accounts and changing the type of user account, leading to the persistence of insecure or empty credentials.
No, this vulnerability requires interaction by a backend user with appropriate privileges.
The impact of this vulnerability is the persistence of insecure or empty credentials for backend user accounts, which can pose a risk to custom authentication service implementations.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
