Log in Start free

Vulnerability · Published May 20, 2025 · Assigned by GitHub_M

CVE-2025-47938TYPO3 Vulnerable to Unverified Password Change for Backend Users

Low 3.8

In plain English

A low-severity security flaw in typo3 from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower the protection against unauthorized access in scenarios where an admin session is hijacked or left unattended, as it enables password changes without additional authentication. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms-core9.5.51GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-core10.4.50GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-core11.5.44GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-core12.4.31GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-core13.4.12GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-setup13.4.12GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-setup9.5.51GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-setup10.4.50GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-setup11.5.44GHSA-3jrg-97f3-rqh9
Packagisttypo3/cms-setup12.4.31GHSA-3jrg-97f3-rqh9

Affected products (as reported)

VendorProductVersions
TYPO3 typo3 >= 9.0.0, < 9.5.51>= 10.0.0, < 10.4.50>= 11.0.0, < 11.5.44>= 12.0.0, < 12.4.31>= 13.0.0, < 13.4.12

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References