-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper type handling in TYPO3's password hashing system. The core issue exists in how hashing implementations are selected (SaltFactory) and verified (AbstractSalt). When using MD5 as the default algorithm, the system incorrectly allows Blowfish-hashed passwords to be validated using MD5's weaker implementation due to PHP class inheritance relationships. The getSaltingInstance() function is central to algorithm selection, making it the primary vulnerable component. The medium confidence in AbstractSalt::checkPassword reflects potential inheritance issues in verification logic, though the exact implementation details would confirm this.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 7.0.0, < 7.6.30 | 7.6.30 |
| typo3/cms | composer | >= 8.0.0, < 8.7.17 | 8.7.17 |
| typo3/cms | composer | >= 9.0.0, < 9.3.2 | 9.3.2 |
A Semantic Attack on Google Gemini - Read the Latest Research