CVE-2014-3945 json
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
published 2014-06-03 12 y ago modified 2026-06-17 4 mo ago also GHSA-h7wf-jg4f-x2wc , EUVD-2014-3879
- cvss
- 4.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
Patch / fix
- packagist typo3/cms 6.2.0
Exploit prediction
1.64% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.0 | AV:N/AC:H/Au:N/C:P/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms | <6.2.0 |
6.2.0 |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
debian.org
/security/2014/dsa-2942
vendor-advisory, web
-
typo3.org
/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/
vendor-advisory
-
openwall.com
/lists/oss-security/2014/06/03/2
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2014-3945
advisory
-
github.com
/TYPO3/typo3
package
-
typo3.org
/security/advisory/typo3-core-sa-2014-001
web
Sources
- CVE List CVE-2014-3945
- GitHub Advisory GHSA-h7wf-jg4f-x2wc
- NVD CVE-2014-3945
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.