GHSA-h7wf-jg4f-x2wc

Source

https://github.com/advisories/GHSA-h7wf-jg4f-x2wc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h7wf-jg4f-x2wc/GHSA-h7wf-jg4f-x2wc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h7wf-jg4f-x2wc

Aliases

CVE-2014-3945

Published

2022-05-17T04:42:47Z

Modified

2025-04-14T16:42:07.460824Z

Severity

9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash

Details

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.

Database specific

{
    "github_reviewed": true,
    "severity": "CRITICAL",
    "github_reviewed_at": "2025-04-14T16:04:38Z",
    "nvd_published_at": "2014-06-03T14:55:00Z",
    "cwe_ids": [
        "CWE-287"
    ]
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h7wf-jg4f-x2wc/GHSA-h7wf-jg4f-x2wc.json"