CVE-2014-3945
published 2014-06-03CVE-2014-3945: The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the…
PriorityP431medium4CVSS 2.0
AVNACHAuNCPIPAN
EPSS
1.64%
73.3th percentile
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
Affected
187 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 0 < 6.2.0 | 6.2.0 |
| typo3 | typo3 | <= 6.1.9 | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
ghsa·2022-05-17
CVE-2014-3945 [CRITICAL] CWE-287 TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
OSV
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
osv·2022-05-17
CVE-2014-3945 [CRITICAL] TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/http://www.debian.org/security/2014/dsa-2942http://www.openwall.com/lists/oss-security/2014/06/03/2http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/http://www.debian.org/security/2014/dsa-2942http://www.openwall.com/lists/oss-security/2014/06/03/2
2014-06-03
Published