-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.20 | 6.2.20 |
| typo3/cms | composer | >= 7.6.0, < 7.6.5 | 7.6.5 |
| typo3/cms | composer | >= 8.0.0, < 8.0.1 | 8.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability centers around improper password validation in TYPO3's core authentication service. The authUser method is the primary authentication entry point that would process password validation. The advisory explicitly identifies the authentication service as the vulnerable component, and this method would contain the logic that failed to reject empty passwords when the database contained empty password hashes (from third-party manipulation). This matches the CWE-287 pattern where authentication checks are incomplete.