-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 8.0.0, < 8.7.23 | 8.7.23 |
| typo3/cms | composer | >= 9.0.0, < 9.5.4 | 9.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the lack of validation for username and password fields during backend user creation/modification. The patch introduced a new hook (BackendUserPasswordCheck::processDatamap_preProcessFieldArray) to enforce these checks. In vulnerable versions, the core DataHandler's processDatamap_preProcessFieldArray method processed user data without these validations, allowing empty/weak credentials to persist. The TCA configuration changes (default disable=1) also indicate insecure defaults in user creation flow, but the primary vulnerability lies in the DataHandler's processing logic without the security hook.