CVE-2025-59015

Insufficient Entropy in Password Generation

Medium6.3EPSS 0.19%

Published: 9 Sept 2025
Updated: 9 Sept 2025
Reserved: 7 Sept 2025
Assigned by: TYPO3

Description

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Scores

CVSS scores of CVE-2025-59015, by who scored it
Scored by	CVSS	Score	Vector
TYPO3CNA (assigner)	4.0	Medium6.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium6.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.19% · top 92% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

CWE-331 Insufficient Entropy (opens in a new tab)All about CWE-331 and its CVEs

Affected products

TYPO3 · TYPO3 CMS
- affected 12.0.0 – < 12.4.37
- affected 13.0.0 – < 13.4.18

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Packagisttypo3/cms-coreGHSA-p5jq-5383-qvc7 (opens in a new tab)

References (1)

https://typo3.org/security/advisory/typo3-core-sa-2025-019 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-59015](https://trackcve.app/badge/CVE-2025-59015.svg)](https://trackcve.app/cve/CVE-2025-59015)

Record last updated 9 Sept 2025, 19:31 UTC.