Vulnerability DatabaseCVE-2025-59015
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-59015
Published:September 09, 2025
Updated:August 05, 2026
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
Affected Packages
typo3/cms-core (PHP):
Affected version(s) >=v12.0.0 <v12.4.37
Fix Suggestion:
Update to version v12.4.37
typo3/cms-core (PHP):
Affected version(s) >=v13.0.0 <v13.4.18
Fix Suggestion:
Update to version v13.4.18
Related Resources (7)
https://packagist.org
https://github.com/TYPO3-CMS/core
https://typo3.org/security/advisory/typo3-core-sa-2025-019
https://github.com/TYPO3/typo3
https://github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70
https://nvd.nist.gov/vuln/detail/CVE-2025-59015
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59015.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Insufficient Entropy
CWE-331
EPSS
Base Score:
0.17