What is GHSA-p5jq-5383-qvc7?

GHSA-p5jq-5383-qvc7 is a security advisory published by GitHub Security Advisories with Medium severity. TYPO3 CMS uses insufficient entropy when generating passwords

Which CVE IDs does GHSA-p5jq-5383-qvc7 cover?

GHSA-p5jq-5383-qvc7 covers the following CVE IDs: CVE-2025-59015. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p5jq-5383-qvc7?

GHSA-p5jq-5383-qvc7 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p5jq-5383-qvc7?

GHSA-p5jq-5383-qvc7 affects 2 products, including: composer/typo3/cms-core:\u003e= 12.0.0, \u003c 12.4.37; composer/typo3/cms-core:\u003e= 13.0.0, \u003c 13.4.18.

GHSA-p5jq-5383-qvc7MediumCVSS 6.5

TYPO3 CMS uses insufficient entropy when generating passwords

Vendor

GitHub Security Advisories

Published

September 9, 2025

Last Modified

September 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-59015 →

📋 Description

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

🎯 Affected products2

composer/typo3/cms-core:>= 12.0.0, < 12.4.37
composer/typo3/cms-core:>= 13.0.0, < 13.4.18

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-59015
https://typo3.org/security/advisory/typo3-core-sa-2025-019
https://github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70
https://github.com/advisories/GHSA-p5jq-5383-qvc7