GHSA-p5jq-5383-qvc7
TYPO3 CMS uses insufficient entropy when generating passwords
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | typo3/cms-core | >= 12.0.0, < 12.4.37 | 12.4.37 |
| Packagist | typo3/cms-core | >= 13.0.0, < 13.4.18 | 13.4.18 |
Details
As written in the advisory (Markdown source, shown as plain text).
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
References
External links from the advisory. They lead to third-party sites.