p PatchFirst

GHSA-6xh8-8pfv-53vx

GHSA-6xh8-8pfv-53vx · Authentication Bypass in TYPO3 CMS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database. Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database.

CVSS 5.4 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3/cms Packagist

    Versions
    • 6.2.0
    • 6.2.1
    • 6.2.10
    • 6.2.10-rc1
    • 6.2.11
    • 6.2.12
    • 6.2.13
    • 6.2.14
    • 6.2.15
    • 6.2.16
    • 6.2.17
    • 6.2.18
    • 6.2.19
    • 6.2.2
    • 6.2.3
    • 6.2.4
    • 6.2.5
    • 6.2.6
    • 6.2.7
    • 6.2.8
    • 6.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 6.2.0, < 6.2.20

    Update to 6.2.20

  • typo3/cms Packagist

    Versions
    • 7.6.0
    • 7.6.1
    • 7.6.2
    • 7.6.3
    • 7.6.4
    Affected ranges
    • ECOSYSTEM: ≥ 7.6.0, < 7.6.5

    Update to 7.6.5

  • typo3/cms Packagist

    Versions
    • 8.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.1

    Update to 8.0.1

Original sources

Check your server →