CVE-2014-3945: The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not r...

Security readout for executives and security teams

TYPO3 sites before 6.2 could let an attacker log in to the backend without the clear password if password salting was disabled and the attacker knew a stored password hash. That turns a leaked database hash into direct administrative access. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is likely limited to legacy TYPO3 deployments before 6.2 where salting for password hashing was disabled and password hashes are exposed or obtainable. Modern installations or systems using salted hashing are not shown as affected by the provided sources. Prioritize legacy TYPO3 systems that are internet-accessible, hold sensitive content, or have any history of database exposure. The business risk is unauthorized backend access, but urgency depends on whether old TYPO3 versions and unsalted hashes still exist in the environment. Mitigation focus: Identify and retire or upgrade TYPO3 installations older than 6.2.; Ensure salted password hashing is enabled where supported by TYPO3.; Apply vendor and distribution guidance from TYPO3 and Debian advisories..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.