CVE-2025-59015 MEDIUM

CVE-2025-59015: Insufficient Entropy in Password Generation

Vendor Typo3
Product TYPO3 CMS
Weakness CWE-331
Published September 9, 2025
Last update September 9, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Key dates

02Disclosure timeline

September 9, 2025 CVE published
September 9, 2025 Record updated