CVE-2015-2047

The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to an empty value.

Published Bysecurity@debian.org

Published DateFeb 23, 2015, 17:59

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

2.6

Vector String

AV:N/AC:H/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-001/
http://www.debian.org/security/2015/dsa-3164
http://www.openwall.com/lists/oss-security/2015/02/22/4
http://www.openwall.com/lists/oss-security/2015/02/22/8
http://www.securityfocus.com/bid/72763
http://www.securitytracker.com/id/1031824
https://review.typo3.org/#/c/37013/

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

2.6

Vector String

AV:N/AC:H/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE