CVE-2024-25118

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-251194.9TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encrypt CVE-2024-251204.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be u CVE-2024-251217.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the Fi CVE-2024-251226.1sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially craf CVE-2024-251237.5MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a m CVE-2024-251249.8Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potential CVE-2024-251255.3Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's CVE-2024-251267.5Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer t CVE-2024-251289.1Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allo CVE-2024-251295.5The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CL CVE-2024-25135.4The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, CVE-2024-251306.5Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Commu