-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.23 | 8.7.23 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.4 | 9.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from the absence of security checks in the DataHandler processing when creating or modifying backend users. The patch introduced a new hook (BackendUserPasswordCheck::processDatamap_preProcessFieldArray) to enforce non-empty credentials and set secure defaults. In vulnerable versions, this hook was missing, allowing empty/weak credentials to persist. However, the core DataHandler functions themselves are not inherently vulnerable; the issue stems from the lack of the security hook and configuration defaults. Thus, no specific vulnerable functions are present in the code—the vulnerability is due to missing safeguards rather than flawed existing functions.
Ongoing coverage of React2Shell