TYPO3 CMS Password Generation Component Insufficient Entropy Vulnerability

A vulnerability exists in the Password Generation component of TYPO3 CMS, specifically in versions 12.0.0 through 12.4.36 and 13.0.0 through 13.4.17. The issue arises from a deterministic three-character prefix that reduces the randomness of generated passwords, enabling attackers to conduct brute-force attacks more efficiently. This vulnerability is not present when the 'random' password rules are used.

Impact

Exploitation of this vulnerability allows for more efficient brute-force attacks on password-protected areas, potentially leading to unauthorized access.

Remediation

Users are advised to update TYPO3 to versions 12.4.37 LTS or 13.4.18 LTS, which address this vulnerability.