CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2025-47938

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower the protection against unauthorized access in scenarios where an admin session is hijacked or left unattended, as it enables password changes without additional authentication. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

Score
3.8 low
Published
2025-05-20
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
www/typo3-11typo3-11-php8211.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8311.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8411.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8511.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8611.5.40_1unaddressedfreebsd-ports@charlieroot.de

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>typo3-11-php82</name>
	<range><lt>9.5.51</lt></range>
      </package>
      <package>
	<name>typo3-11-php83</name>
	<range><lt>9.5.51</lt></range>
      </package>
      <package>
	<name>typo3-11-php84</name>
	<range><lt>9.5.51</lt></range>
      </package>
      <package>
	<name>typo3-11-php85</name>
	<range><lt>9.5.51</lt></range>
      </package>
      <package>
	<name>typo3-11-php86</name>
	<range><lt>9.5.51</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>TYPO3 is an open source, PHP based web content management system.
	Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50
	ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user
	management interface allows password changes without requiring the
	current password. When an administrator updates their own account or
	modifies other user accounts via the admin interface, the current
	password is not requested for verification. This behavior may lower
	the protection against unauthorized access in scenarios where an admin
	session is hijacked or left unattended, as it enables password changes
	without additional authentication. Users should update to TYPO3
	version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or
	13.4.12 LTS to fix the problem.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-47938</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47938</url>
    </references>
    <dates>
      <discovery>2025-05-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>