-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of PHP class inheritance in TYPO3's Salted Password system. When MD5 is the default hashing algorithm, the system incorrectly allows Blowfish-hashed passwords to be overridden due to shared parent classes in the hashing method implementations. The SaltFactory::getHashing method is central to selecting the hashing algorithm, and CompatibilityHashService::checkPassword handles password verification. Both functions would need to misuse inheritance checks (e.g., is_subclass_of or instanceof) to allow cross-algorithm validation. The high confidence comes from the vulnerability's direct link to class inheritance in password hashing logic, as described in the advisory.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.17 | 8.7.17 |
| typo3/cms-core | composer | >= 9.0.0, < 9.3.2 | 9.3.2 |
| typo3/cms-core |
| composer |
| >= 7.0.0, < 7.6.30 |
| 7.6.30 |
Ongoing coverage of React2Shell