CVE-2025-59015CWE-331

Insufficient Entropy in Password Generation

Medium · published September 9, 2025

CVSS v4.0
6.3
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00187 · 7.9th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2025-09-09T09:00Z
EPSS history
Timeline
  • 09 SEP 09:00Z
    Insufficient Entropy in Password Generation
    cvelistv5